Security Incident Report Form Template

SECURITY INCIDENT REPORT FORM AGREEMENT

This Security Incident Report Form Agreement (the "Agreement") is entered into as of [Effective Date] (the "Effective Date") by and between [Company Name], a [Jurisdiction] corporation with its principal place of business located at [Company Address] ("Disclosing Party"), and [Vendor/Recipient Name], a [Jurisdiction] corporation with its principal place of business located at [Vendor Address] ("Receiving Party"). The Disclosing Party and Receiving Party are collectively referred to as the "Parties."

1. PREAMBLE AND RECITALS

WHEREAS, the Parties have entered into a Master Services Agreement dated [MSA Date] (the "MSA"); WHEREAS, the Parties acknowledge the necessity of maintaining robust cybersecurity protocols and the formalization of reporting obligations in the event of a Security Incident; WHEREAS, the Parties desire to establish a binding legal framework for the notification, investigation, and remediation of such incidents to protect proprietary data and comply with applicable laws; NOW, THEREFORE, in consideration of the mutual covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

2. OPERATIONAL DEFINITIONS

1. "Security Incident" means any actual or suspected unauthorized access, use, disclosure, modification, or destruction of Protected Data or the compromise of the integrity or availability of systems housing Protected Data.
2. "Protected Data" shall have the meaning ascribed to it in the MSA, including but not limited to Personally Identifiable Information (PII), Intellectual Property, and Confidential Information.
3. "Business Day" means any day other than a Saturday, Sunday, or a day on which commercial banks in [Jurisdiction] are authorized or required by law to be closed.
4. "Remediation Plan" means the written strategy developed by the Receiving Party to address, contain, and mitigate the impact of a Security Incident.

3. SUBSTANTIVE TERMS AND OBLIGATIONS

1. Notification Duty: Upon discovery of a Security Incident, the Receiving Party shall provide written notice to the Disclosing Party’s Security Officer via email at [Security Email Address] within twenty-four (24) hours.
2. The Report Form: The Receiving Party shall complete the "Security Incident Report Form" (Annex A) in its entirety, disclosing the nature of the breach, the systems impacted, and the potential exposure of Protected Data.
3. Investigation Cooperation: The Receiving Party shall grant the Disclosing Party reasonable access to the Receiving Party’s logs, infrastructure, and technical personnel to verify the scope of the incident.
4. Representations: Each Party represents that it maintains commercially reasonable cybersecurity safeguards and adheres to industry-standard frameworks (e.g., ISO 27001 or NIST).
5. Data Preservation: The Receiving Party shall maintain an immutable audit trail of all actions taken during and after the discovery of the incident for a period of no less than [Number] years.

4. DEFAULT, TERMINATION, AND REMEDIES

1. Material Breach: Failure to report a Security Incident within the prescribed timeframe or failure to implement a mutually agreed-upon Remediation Plan shall constitute a material breach of this Agreement.
2. Cure Period: The breaching party shall have thirty (30) Business Days from the receipt of written notice of a breach to cure said default.
3. Remedies: In the event of an uncured breach, the non-breaching party may seek: (a) immediate termination of the MSA; (b) injunctive relief; or (c) liquidated damages in the amount of [Dollar Amount], as a pre-estimated measure of loss, not as a penalty.

5. BOILERPLATE LEGAL PROVISIONS

1. Severability: If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
2. Entire Agreement: This Agreement constitutes the entire agreement between the Parties regarding the subject matter hereof and supersedes all prior discussions or memoranda.
3. Force Majeure: Neither party shall be liable for failure to perform due to acts of God, war, terrorism, or other events beyond their reasonable control, provided that the non-performing party provides immediate notice of the force majeure event.
4. Governing Law: This Agreement shall be governed by and construed in accordance with the laws of [Jurisdiction], without regard to its conflict of law principles.
5. Dispute Resolution: Any dispute arising out of this Agreement shall be settled by binding arbitration in [City, State] under the rules of the American Arbitration Association.

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

[Company Name]

Signature: __________________________ Name: [Signatory Name] Title: [Signatory Title] Date: ______________________________

[Vendor/Recipient Name]

Signature: __________________________ Name: [Signatory Name] Title: [Signatory Title] Date: ______________________________