Security Incident Report Form Mod

SECURITY INCIDENT REPORT FORM MOD

1. Document Preamble & Recitals

THIS SECURITY INCIDENT REPORT FORM MOD (hereinafter the "Agreement" or "Form") is entered into and made effective as of [Effective Date] (the "Effective Date"), by and between:

[Company Name], a [State/Country of Incorporation] [Corporation/LLC] having its principal place of business located at [Company Address] (hereinafter referred to as the "Disclosing Party" or "Data Controller"), and

[Counterparty Name], a [State/Country of Incorporation] [Corporation/LLC] having its principal place of business located at [Counterparty Address] (hereinafter referred to as the "Receiving Party" or "Data Processor").

WHEREAS, the Parties have entered into a primary commercial, operational, or services agreement dated [Date of Underlying Agreement] (the "Underlying Agreement"), pursuant to which the Receiving Party accesses, processes, stores, or transmits Confidential Information and/or Personally Identifiable Information belonging to or controlled by the Disclosing Party; and

WHEREAS, the Parties intend by this Agreement to establish mandatory operational protocols, immediate reporting obligations, standardized data fields, and legal liabilities concerning any Security Incident impacting Information Systems, networks, physical security boundaries, or data assets managed or maintained under the scope of the Underlying Agreement; and

WHEREAS, this Agreement shall operate as a binding legal modification and supplement to the Underlying Agreement, establishing strict timelines and evidentiary standards under the laws of [Jurisdiction].

NOW, THEREFORE, in consideration of the mutual covenants, promises, and legal obligations contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

---

2. Operational Definitions

For the purposes of this Agreement, the following terms shall have the meanings ascribed below, and such definitions shall be read in conjunction with, and supplemental to, the Underlying Agreement:

1. "Compromised Data" means any electronic, digital, or physical data, records, or files that have been subjected to unauthorized access, acquisition, alteration, destruction, exfiltration, or disclosure during the course of a Security Incident.
2. "Confidential Information" shall have the meaning ascribed in the Underlying Agreement and shall additionally include all proprietary data, trade secrets, security credentials, operational logs, and customer information accessible by the Receiving Party.
3. "Discovery" or "Discovered" means the exact moment, timestamp, or event wherein the Receiving Party's security monitoring systems, personnel, contractors, or agents first detect anomalous behavior, indicators of compromise, or have actual or constructive knowledge suggesting a potential or actual Security Incident.
4. "Information Systems" means any computers, hardware, software, databases, cloud environments, networks, electronic storage devices, or telecommunications infrastructure owned, leased, operated, or utilized by the Receiving Party or its subcontractors to store, process, or transmit the Disclosing Party's data.
5. "Personally Identifiable Information (PII)" means any information that can be used to distinguish, identify, or contact a specific living individual, alone or in combination with other demographic, personal, or technical data, whether protected by applicable privacy statutes (including but not limited to GDPR, CCPA, HIPAA) or contractual stipulations.
6. "Security Incident" means any suspected, attempted, or confirmed unauthorized access, acquisition, use, disclosure, modification, disruption, or destruction of Information Systems, Confidential Information, or PII, including but not limited to cyber-attacks, ransomware, malware deployment, unauthorized privilege escalation, insider threats, and physical breaches of data centers.
7. "Subcontractor" means any third-party vendor, affiliate, contractor, or agent engaged by the Receiving Party that maintains access to Information Systems or processes the Disclosing Party's data.

---

3. Substantive Terms & Obligations

3.1 Mandatory Incident Notification Timeline

The Receiving Party shall provide written notice of any Security Incident to the Disclosing Party's designated security contact via electronic mail and telephone immediately upon Discovery, and in no event later than [Number, e.g., 24] hours following Discovery. The passage of this notification window is of the essence.

3.2 Formal Incident Reporting Protocol

Within [Number, e.g., 48] hours of initial Discovery, the Receiving Party shall submit a fully completed, verified copy of this Security Incident Report Form Mod, containing at minimum the following mandatory data fields:

1. Chronological timeline of the Security Incident, from initial vector to Discovery and containment;
2. Detailed technical description of the nature and scope of the Security Incident;
3. Identification of all Information Systems, network segments, and applications affected;
4. Comprehensive categorization and inventory of all Compromised Data, including specific data fields and number of affected data subjects (if applicable);
5. Remediation steps already deployed and pending operational containment measures; and
6. Identification of root cause analysis findings, to the extent determined.

3.3 Ongoing Cooperation and Forensic Preservation

The Receiving Party shall immediately isolate, preserve, and protect all digital, physical, and forensic evidence relating to the Security Incident, including server logs, memory dumps, firewall logs, and physical access records. The Receiving Party shall grant the Disclosing Party, its legal counsel, and its designated forensic investigators immediate, unrestricted access to inspect affected Information Systems, interview relevant technical personnel, and review forensic artifacts.

3.4 Mitigation, Remediation, and Cost Allocation

The Receiving Party shall deploy all commercially reasonable and technologically advanced resources at its disposal to immediately contain, mitigate, and remediate the Security Incident, eradicate threats, and restore systems to secure operational status. All direct and indirect costs associated with the Security Incident—including but not limited to forensic investigations, legal fees, credit monitoring services for affected individuals, regulatory fines, public relations support, and mandatory notifications—shall be borne exclusively by the Receiving Party, subject to the liability caps set forth in Section 4.

3.5 Representations and Warranties

The Receiving Party represents and warrants that:

1. It maintains a comprehensive information security program compliant with industry standards (e.g., ISO/IEC 27001, NIST CSF);
2. All Subcontractors handling the Disclosing Party's data are bound by written security obligations at least as restrictive as those contained herein; and
3. It shall promptly comply with all applicable local, state, federal, and international data protection laws regarding security incident disclosure and notification.

---

4. Default, Termination, and Remedies

4.1 Classification of Breach

Any failure by the Receiving Party to timely report a Security Incident pursuant to Section 3.1, submit an accurate and complete report pursuant to Section 3.2, cooperate fully with forensic investigations pursuant to Section 3.3, or maintain adequate security controls shall constitute an immediate, material, and non-curable breach of this Agreement and the Underlying Agreement.

4.2 Notice and Cure Period

For any other administrative or operational breach of this Agreement not involving an immediate data compromise, the non-breaching Party shall provide written notice of default specifying the particulars of the breach. The breaching Party shall have thirty (30) business days from the receipt of such notice to cure said default to the reasonable satisfaction of the non-breaching Party. Failure to cure within the designated 30-business-day window shall result in immediate termination of the Underlying Agreement for cause.

4.3 Legal Recourse and Injunctive Relief

In the event of a material breach or threatened breach of this Agreement, the Disclosing Party reserves all rights at law or in equity, including the right to immediately terminate the Underlying Agreement without penalty, suspend all data processing operations, and seek immediate injunctive relief from a court of competent jurisdiction without the requirement of posting a bond, acknowledging that monetary damages alone would be inadequate to compensate for the unauthorized exposure of Confidential Information and PII.

---

5. Boilerplate Legal Provisions

5.1 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court or tribunal of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if incapable of such modification, severed from this Agreement. The remaining provisions shall continue in full force and effect without impairment.

5.2 Entire Agreement

This Agreement, together with the Underlying Agreement, constitutes the final, complete, and exclusive expression of the agreement between the Parties with respect to its subject matter and supersedes all prior or contemporaneous oral or written negotiations, understandings, proposals, or agreements relating thereto. No modification or amendment of this Agreement shall be valid unless executed in writing by authorized representatives of both Parties.

5.3 Force Majeure

Neither Party shall be liable for any failure or delay in the performance of its operational obligations under this Agreement if such failure or delay is caused by acts of God, natural disasters, war, terrorism, civil unrest, or governmental embargoes (each a "Force Majeure Event"); provided, however, that a Force Majeure Event shall not excuse, mitigate, or delay the Receiving Party's reporting obligations, containment duties, or liability for any Security Incident resulting from cyber-attacks, malware, ransomware, human error, or technical failure within the control of the Receiving Party or its Subcontractors.

5.4 Governing Law

This Agreement, and all claims or causes of action arising out of or relating to it, shall be governed by, construed, and enforced in accordance with the substantive laws of the State of [Jurisdiction], without regard to its conflict of laws principles.

5.5 Dispute Resolution

Any dispute, controversy, or claim arising out of or relating to this Agreement, including its formation, breach, termination, or validity, shall be settled by binding arbitration administered by the [Name of Arbitration Body, e.g., American Arbitration Association] in accordance with its commercial arbitration rules. The place of arbitration shall be [City, State], and the proceedings shall be conducted in the English language before a single arbitrator. The award rendered by the arbitrator shall be final and binding, and judgment upon the award may be entered in any court having jurisdiction thereof.

---

6. Formal Execution Block

IN WITNESS WHEREOF, the Parties hereto have caused this Security Incident Report Form Mod to be duly executed by their respective authorized officers, effective as of the Effective Date written above.

DISCLOSING PARTY:

[Company Name]

By: _________________________________________
Name: [Authorized Signatory Name]
Title: [Title/Office Held]
Date: [Date of Execution]

---

RECEIVING PARTY:

[Counterparty Name]

By: _________________________________________
Name: [Authorized Signatory Name]
Title: [Title/Office Held]
Date: [Date of Execution]