CYBERSECURITY AUDIT AGREEMENT

This Cyber Security Audit Agreement (hereinafter referred to as the “Agreement”) is made on [INSERT THE DATE ON WHICH AGREEMENT COMES INTO FORCE] (hereinafter referred to as the “Effective Date”) between:

[INSERT NAME OF THE COMPANY], having registered office at [INSERT ADDRESS OF THE COMPANY] (hereinafter referred to as the “Company” which expression shall, unless repugnant to the context or meaning thereof, means and includes its legal representatives, executors, administrators and permitted assigns); and 

[INSERT NAME OF THE INDIVIDUAL], having registered office at [INSERT ADDRESS OF THE INDIVIDUAL] (hereinafter referred to as the “Auditor” which expression shall, unless repugnant to the context or meaning thereof, means and includes its legal representatives, executors, administrators and permitted assigns).

The “Company” and the “Auditor” together shall be referred to as “Parties” and individually as a “Party”.

WHEREAS:

1. The Company is engaged in the Business of [INSERT BUSINESS DETAILS] and agrees to hire Auditor for professional Cyber Security Auditing services to manage their networks, systems and to protect the Company’s Data from Cyber threats.
2. The Auditor is engaged in providing Cyber Security Auditing services and possesses necessary expertise and qualifications to provide such services.
3. The Parties mutually agree to the terms and conditions outlined in this Agreement, which governs the working relationship between the parties.
4. The parties are duly authorized and have the capacity to enter into this agreement.
5. Both the parties affirm to understand the provisions contained herein and in case either party requires clarification as to one or more provisions, either party has had the right to seek clarifications or sought legal guidance.

NOW, THEREFORE, in consideration of the mutual promises contained herein and intending to, be legally bound, the Parties have agreed as follows:

1. DEFINITIONS
   1. “Auditor” shall mean an individual or entity who is engaged in providing Cyber Security auditing services to the Company.
   2. “Cyber Security Auditing” shall mean auditing or maintaining systems, online platforms and protecting Company’s online networks from cyber threats.
   3. “Confidential Information” shall mean the any non-public information, data, documentation, trade secrets, know-how, or any other information disclosed by one party (Auditor) to the other party (Company) in connection with the terms and conditions whether in written, oral, electronic, or any other form, and identified as confidential or which the parties should reasonably understand to be confidential.
2. SCOPE OF WORK
   1. The Auditor shall perform a comprehensive Cybersecurity Audit for the Company in accordance with industry best practices and applicable legal and regulatory standards. The scope of the services to be provided under this Agreement shall include, but is not limited to:
      1. Evaluation of the Company’s internal and external networks to identify vulnerabilities, misconfigurations, and potential points of unauthorized access.
      2. Analysis of operating systems, web applications, and software infrastructure for known threats, outdated versions, and improper configurations.
      3. Identification and documentation of security risks, their potential impact, and likelihood, including recommendations for mitigation.
      4. Execution of controlled testing procedures to detect exploitable weaknesses in the Company’s infrastructure, applications, and access controls.
      5. Assessment of the Company’s cybersecurity posture with respect to applicable data protection laws, industry standards and regulatory requirements.
      6. Review of existing cybersecurity policies, procedures, and incident response plans, and suggestions for improvements where necessary.
      7. Delivery of a detailed Cybersecurity Audit Report summarizing findings, compliance status, detected vulnerabilities, and prioritized recommendations for remediation.
      8. All services shall be performed with the utmost regard to confidentiality, ensuring secure handling and processing of all Company data accessed during the audit.
      9. The Auditor shall adhere to the agreed project timeline and maintain regular communication with designated representatives of the Company throughout the audit process.
3. TERM
   1. This Agreement shall commence on the effective date of [INSERT DATE OF AGREEMENT] and continue for [INSERT TERM PERIOD OF AGREEMENT IN DAYS/MONTHS/YEARS] as agreed by the parties. The Agreement may be terminated earlier in accordance with the termination provisions set forth herein, including termination upon mutual written consent or any other conditions specified within the Agreement that allow for early termination.
4. OBLIGATIONS OF THE AUDITOR
   1. The Auditor shall perform the Cybersecurity Audit services diligently and professionally, in accordance with applicable laws, industry standards, and the Scope of Work defined in this Agreement.
   2. The Auditor shall conduct all audit-related activities, including assessments, testing, and reporting, in a manner that shall preserve the integrity and availability of the Company’s systems and data.
   3. The Auditor shall maintain complete, accurate, and current records of all audit activities and findings and shall provide such records to the Company as part of the required reporting.
   4. The Auditor shall deliver the final audit report and supporting documentation, including risk assessments and recommendations, within the timeframe agreed upon by the Parties.
   5. The Auditor shall treat all Company data, documents, and information received or accessed during the term of this Agreement as confidential and shall handle such information in strict accordance with the Confidentiality Clause.
   6. The Auditor shall promptly notify the Company of any critical vulnerabilities or cybersecurity threats identified during the audit process.
   7. Upon termination or expiration of this Agreement, the Auditor shall return or securely destroy all Company materials, data, and audit-related documents in accordance with the Company’s instructions.
5. OBLIGATIONS OF THE COMPANY
   1. The Company shall provide the Auditor with full and timely access to all systems, networks, platforms, and documentation necessary to perform the audit services under this Agreement.
   2. The Company shall designate a representative to serve as the primary point of contact and shall ensure effective communication and cooperation with the Auditor throughout the duration of the engagement.
   3. The Company shall supply any information or data requested by the Auditor in a timely manner, as required to perform the audit services effectively.
   4. The Company shall make all payments to the Auditor in accordance with the terms set forth in the Payment Clause of this Agreement.
   5. The Company shall cooperate in good faith with the Auditor to facilitate the successful execution of the audit process.
   6. The Company shall review and, where appropriate, shall take reasonable steps to implement critical recommendations or urgent remediations identified in the audit report.
6. PAYMENT
   1. Company hereby agrees to pay to Auditor the following amount [INSERT AMOUNTPAYBLE TO AUDITOR] on a [INSERT PAYMENT SCHEDULE E.G., MONTHLY, QUARTERLY OR YEARLY] basis as agreed upon by both the parties.
   2. Payments shall be paid by Company to Audit on or before [INSERT DUE DATE FOR PAYMENT]. Payments shall be made in [INSERT FIAT CURRENCY] through [INSERT MODE OF PAYMENT].
7. REPRESENTATION AND WARRANTIES
   1. The Auditor represents and warrants that it is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation or residence, and has full power and authority to enter into and perform its obligations under this Agreement.
   2. The Auditor represents and warrants that it possesses the necessary qualifications, expertise, licenses, certifications, personnel, and resources to perform the Cybersecurity Audit services in a competent, professional, and timely manner, in accordance with the Scope of Work and industry standards.
   3. The Auditor shall ensure that all personnel involved in the audit are adequately trained and bound by confidentiality obligations no less stringent than those contained in this Agreement.
   4. The Auditor further represents and warrants that the performance of its obligations under this Agreement does not and shall not violate any applicable laws, regulations, or third-party rights, including intellectual property rights.
   5. The Auditor represents that, to the best of its knowledge, no litigation, arbitration, or administrative proceeding is pending or threatened that could have a material adverse effect on its ability to perform its obligations under this Agreement.
   6. The Company represents and warrants that it is duly incorporated, validly existing, and in good standing under the laws of its jurisdiction and has the full power and authority to enter into and perform its obligations under this Agreement.
   7. The Company represents and warrants that it has obtained all necessary authorizations, consents, and approvals required to engage the Auditor and to allow access to its systems, networks, platforms, and documentation for the purpose of the Cybersecurity Audit.
   8. The Company shall ensure that all information and data provided to the Auditor in connection with this Agreement is accurate, complete, and not misleading to the best of its knowledge.
   9. The Company represents that the execution and delivery of this Agreement and the performance of its obligations do not and shall not conflict with or result in a breach of any other agreement, judgment, or legal obligation binding upon it.
8. REPORTS AND INFORMATION
   1. The Auditor shall maintain complete Audit records of systems and networks in accordance with applicable legal regulations, and provide the Company with regular Audit reports, for the year starting from [INSERT START DATE] till [INSERT END DATE] as agreed upon by the parties.
   2. The Company agrees to promptly provide all necessary data to perform the cyber security audit.
   3. The Company retains ownership of all Audit reports, and documents produced by the Auditor during the course of providing services under this Agreement.
   4. In the event of termination of this Agreement, the Auditor shall provide the Company with a complete and orderly transfer of all Audit records and reports in their possession.
   5. The Auditor shall maintain confidentiality of all information and reports provided by the Company, as outlined in the Confidentiality clause of this Agreement.
9. DELIVERABLES
   1. The Auditor shall perform in accordance with the following [INSERT STATEMENT OF WORK].
   2. The Auditor agrees to prepare and deliver the audit report in accordance with the timeframe mentioned. This report will include findings, conclusions and any recommendations arising from the Audit.
   3. The Auditor shall provide and submit Risk Assessment documentation and planning.
10. CONFIDENTIALITY
    1. Confidential Information shall not include any information that: (i) is or becomes generally known to the public without either Party’s breach of any obligation owed to the other Party; (ii) was independently developed by a Party without other Party's breach of any obligation owed to that Party; or (iii) is received from a third party who obtained such Confidential Information without any third party's breach of any obligation owed to the Party.
    2. During and after the term of this Agreement, Parties will hold in the strictest confidence, and take all reasonable precautions to prevent any unauthorized use or disclosure of Confidential Information, and Parties will not (i) use the Confidential Information for any purpose whatsoever other than as necessary for the performance of the Services on behalf of the other Party, or (ii)  disclose the Confidential Information to any third party without the prior written consent of an authorized representative of the other Party.
    3. Parties agrees to protect the confidentiality of the Confidential Information in the same manner that it protects the confidentiality of its own proprietary and confidential information of like kind, but in no event shall the Parties exercise less than reasonable care in protecting such Confidential Information.
    4. The Parties shall not use any confidential information directly or indirectly to procure a commercial advantage over the other Party or otherwise use any designs, ideas or concepts created by or belonging to the other Party without the express written consent of the other Party.
    5. Upon termination/ expiration whichever is earlier, the Parties shall promptly return or certify the destruction of Confidential Information and all authorized copies thereof.
11. OWNERSHIP AND INTELLECTUAL PROPERTY RIGHTS
    1. The Auditor covenants that it will not claim any right, title or interest whether at law or in equity or in any Intellectual Property of the Company’s business and that the Company shall be the sole, exclusive and absolute owner of all.
12. TERMINATION
    1. Either party may terminate this Agreement for material breach on [INSERT THE NUMBER OF DAYS FOR NOTICE OF TERMINATION] days' written notice with opportunity to cure; provided termination will become effective immediately upon such notice, without opportunity to cure, if:
       1. this Agreement provides a specific date or period for performance of the obligation breached; or
       2. the injury caused by the breach is of a type that cannot be materially reduced by the breaching party during the cure period.
    2. Upon expiration or termination of this Agreement, all rights and obligations of the parties shall immediately cease, except for those obligations that have accrued prior to the effective date of termination. Specifically, any outstanding payment obligations, as well as any liabilities or breaches incurred before termination, shall remain fully enforceable. No new rights or obligations shall arise or be enforceable following termination, except for those expressly provided to survive termination within this Agreement.
    3. If this Agreement is terminated in accordance with its termination provisions, it shall become null and void and have no further force or effect, except that the Parties shall continue to be bound by its provisions regarding confidentiality and restrictions on announcements, indemnification, confidentiality, non-solicitation, non-disparagement, notices, miscellaneous matters, and governing law and dispute resolution. Nothing in this clause shall release any Party from any liability for any breach of this Agreement occurring prior to the effective date of such termination.
13. INDEMNIFICATION
    1. Each party (“Indemnifying Party”) shall indemnify, defend, and hold harmless the other party, its affiliates, officers, directors, employees, agents, successors, and assigns (“Indemnified Party”) from and against any and all claims, demands, actions, suits, or proceedings initiated by third parties, as well as any resulting liabilities, damages, losses, costs, and expenses, including reasonable attorneys’ fees, to the extent such claims arise from;
       1. any breach by the Indemnifying Party of its covenants, agreements, or obligations under this Agreement;
       2. any inaccuracy or material misrepresentation in the representations or warranties made by the Indemnifying Party; or
       3. any claim that the use, licensing, or commercialization of intellectual property or proprietary rights by the Indemnifying Party infringes, misappropriates, or otherwise violates the rights of any third party. The Indemnified Party shall provide prompt written notice of any claim for which indemnification is sought, and the Indemnifying Party shall have the right to assume and control the defence with counsel of its choosing, subject to the Indemnified Party’s reasonable approval.
    2. The Indemnified Party shall cooperate in good faith, and while it may participate in the defence at its own expense, the Indemnifying Party shall not settle any claim without the Indemnified Party’s prior written consent if such settlement imposes liability, does not provide a full release, or includes an admission of wrongdoing. Indemnification shall not apply to the extent that the claim arises from the Indemnified Party’s own wilful misconduct, negligence, or material breach of this Agreement.
14. LIMITATION OF LIABILITY
    1. Neither Party shall be liable to the other for any indirect, incidental, special, exemplary, punitive, or consequential damages, including but not limited to loss of profits, loss of business, loss of data, or business interruption, arising out of or in connection with this Agreement, whether in contract, tort, negligence, strict liability, or otherwise, even if advised of the possibility of such damages.
    2. The total aggregate liability of either Party for any and all claims arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise, shall not exceed the total amount paid or payable by the Company to the Auditor under this Agreement in the [INSERT THE NUMBER OF DAYS/MONTH/YEAR] agreed by the parties preceding the claim.
    3. While the Auditor shall take reasonable care in the performance of its services and in identifying vulnerabilities and risks, the Auditor does not warrant that all cyber threats will be detected or that the audit shall result in complete security. The Company acknowledges that cybersecurity involves inherent risks and shall remain responsible for implementing recommendations and maintaining ongoing security measures.
    4. Neither Party shall be liable for any failure or delay in performance under this Agreement due to causes beyond its reasonable control, as described in the Force Majeure Clause herein.
15. DISPUTE RESOLUTION
    1. The Parties shall endeavour to resolve any differences of opinion which may arise between them with respect to the provisions of this Agreement by negotiation between themselves personally or with the assistance of their attorneys and unless in the opinion of any party, acting reasonably, the matter in dispute is of such significant nature to warrant it being addressed otherwise, no party shall commence any public proceedings until the negotiations have failed to produce a resolution. In furtherance of the provisions of this paragraph, all Parties hereby agree to make themselves available on short notice and to negotiate promptly and in good faith, any matter any party may wish to negotiate.
    2. All disputes arising under this agreement shall be governed by and interpreted in accordance with the Arbitration laws of [INSERT COUNTRY/STATE OF ARBITRATION] , without regard to principles of conflict of laws. The parties to this agreement will submit all disputes arising under this Agreement to Arbitration in [INSERT COUNTRY/STATE OF ARBITRATION] before a single arbitrator. The arbitrator shall be selected by mutual agreement of the parties. The venue of Arbitration proceedings shall be [INSERT NAME OF COUNTRY AND CITY WHERE ARBITRATION SHALL BE CONDUCTED] No party to this agreement will challenge the jurisdiction or venue provisions as provided in this section. The decision of the Arbitrator shall be final and binding upon the parties.
16. APPLICABLE LAW
    1. This Agreement shall be governed by and constructed in accordance with the Laws, rules, orders and regulations of [INSERT THE COUNTRY/STATE OF APPLICABLE LAWS].
    2. The Parties shall resolve all disputes in connection with the validity or interpretation of this Agreement, unless otherwise expressly stated in the Agreement, in the following manner: 
       1. By direct negotiations between the Company and Auditor.
       2. If negotiations between the parties are unsuccessful, the matter shall be referred to the competent court sitting at [INSERT THE PLACE OF THE COURT WHICH SHALL HAVE EXCLUSIVE JURISDICTION IN CASE OF UNSUCCESSFUL NEGOTIATION] which shall have exclusive jurisdiction in all matters arising there from unless otherwise agreed between the Parties in writing.
17. FORCE MAJEURE
    1. In the event that either party is unable to perform any of its obligations under this Agreement or to enjoy any of its benefits because of any Act of God, strike, fire, flood, governmental acts, orders or restrictions, Internet system unavailability, system malfunctions, pandemic or any other reason where failure to perform is beyond the reasonable control and not caused by the negligence of the non-performing party (a “Force Majeure Event”), the party who has been so affected shall give notice immediately to the other party and shall use its reasonable best efforts to resume performance. Failure to meet due dates resulting from a Force Majeure Event shall extend such due dates for a reasonable period. However, if the period of nonperformance exceeds (NO OF DAYS) days from the receipt of notice of the Force Majeure Event, the party whose ability to perform has not been affected may, by giving written notice, terminate this Agreement effective immediately upon such notice or at such later date as is therein specified.
18. NON- DISPARAGEMENT
    1. The Parties agree that neither they nor any of their representatives, agents, employees, or affiliates shall, directly or indirectly, make or publish any statements, comments, or communications, whether orally, in writing, or electronically, including through any channel such as social media platforms, websites, forums, or other public or private means, that disparage, defame, or negatively portray the other Party, its business, products, services, employees, or reputation.
    2. This clause does not prohibit a Party from making truthful statements when required by law, regulation, or valid court order, provided the Party uses reasonable efforts to provide prior notice to the other Party, to the extent permitted by law.
19. DATA PROTECTION
    1. Both Parties agree to comply with all applicable data protection laws and regulations in connection with the processing of personal data under this Agreement, including any highly sensitive personal information. Personal data shall be collected, processed, and stored lawfully, fairly, and transparently for specific and legitimate purposes. Each Party shall implement appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or destruction. Data transfers across jurisdictions shall only occur in compliance with legally recognized mechanisms.
    2. In the event of any actual or suspected data breach affecting Customer data, including highly sensitive personal information, the Service Provider shall promptly notify the Customer in writing and provide all reasonable assistance to mitigate risks and comply with applicable breach notification requirements. Each Party shall ensure that data subjects can exercise their rights regarding access, rectification, erasure, restriction of processing, and objection to automated decision-making. Any third-party processing must be governed by a legally binding agreement ensuring compliance with applicable laws. Upon termination of this Agreement, personal data shall be securely deleted unless legal obligations require retention. This clause shall be governed by applicable data protection laws, and disputes shall be resolved in accordance with those regulations.
20. NOTICES
    1. Any notice, request, demand, consent or other communication required or permitted under this Agreement shall be in writing and sent either via email on the email address as provided by the parties and shall be considered sent when the email is sent to the correct email address of the party or shall be given by personal delivery (including courier) by certified mail (confirmed by mail) addressed to the party for which it is intended at the address below and shall be deemed to be given on the day of delivery or transmission if within during normal business hours, or, if after business hours, on the next following Business Day, or if mailed by registered or certified mail, on the day which is [INSERT THE APPLICABLE NUMBER OF BUSINESS DAYS WITHIN WHICH THE NOTICE WILL BE DEEMED SERVED] Business Days after such notice is mailed during normal postal conditions.  In the event of a postal disruption, any notice mailed will be deemed received on the [INSERT THE APPLICABLE NUMBER OF BUSINESS DAYS WITHIN WHICH THE NOTICE WILL BE DEEMED SERVED] Business Day following resumption of regular postal service:
       1. If to the Company: [INSERT EMAIL ID OR/AND ADDRESS OF THE COMPANY]
       2. If to the Auditor: [INSERT EMAIL ID OR/AND ADDRESS OF THE AUDITOR]
    2. Either party may change its address/email address for notices and other communications upon notice to the other party in the manner aforesaid.
21. MISCELLANOUS
    1. Modifications: Except as otherwise provided herein this Agreement shall not be amended or otherwise modified unless the modification or amendment is done in writing, signed and has been mutually agreed by both the parties.
    2. Language: The language of all communications between the parties pursuant to this Agreement, including notices and reports, will be the [INSERT LANGUAGE OF ALL COMMUNICATION].
    3. Severability: If any provision of this Agreement shall, to any extent, be held to be invalid or unenforceable, it shall be deemed to be separate and severable from the remaining provisions of this Agreement, which shall remain in full force and effect and be binding as though the invalid or unenforceable provision had not been included.
    4. Entire agreement: This agreement along with all the Exhibits constitutes the entire understanding and agreement of the parties with respect to its subject matter and supersedes all prior and contemporaneous agreements or understandings, inducements or conditions, express or implied, written or oral, between the parties. This Agreement may be executed in identical duplicate counterparts, each of which shall be deemed an original, and both of which together shall constitute one and the same instrument. 
    5. No Waiver: Any failure or delay of any Party hereto in exercising any right or privilege with respect to this Agreement shall not be construed to be a waiver or to affect the validity of any part of the Agreement and shall not retrain any of the Parties to enforce any of the provisions of the Agreement.
    6. Amendments and Assignments:  Any amendments to this Agreement shall be made, only if, both Parties agree upon such amendment in writing. This Agreement shall not be assigned by either party without the express, written consent of the other party.
    7. Headings: The headings upon the various sections are solely for convenience and reference only and shall not affect the scope, meaning, intent or interpretation of the provisions of this Agreement, nor shall such headings otherwise be given any legal effect.
22. INDEPENDENT LEGAL ADVICE
    1. The Parties are advised to seek independent legal counsel before entering into this Agreement. Each Party acknowledges that they have been given a reasonable opportunity to consult with an attorney of their choosing regarding the terms, conditions, and obligations set forth in this Agreement, including any restrictions or commitments imposed herein.
    2. By signing this Agreement, the Parties confirm that they have either sought such independent legal advice or voluntarily chosen to proceed without it. Each Party further represents that they are entering into this Agreement knowingly, voluntarily, and with a full understanding of its provisions. The Parties acknowledge that they are not relying on any statements, promises, or representations made by the other Party or any representative thereof that are not expressly included in this Agreement.
23. DECLARATION
    1. The Parties hereby acknowledge that the terms herein have been read, fully understood, and expressly agreed to, and hereby commit to performing their obligations with due diligence, honesty, and in good faith. The Parties hereby agree to foster a collaborative environment that promotes transparent communication and timely resolution of any issues, thereby ensuring compliance with all applicable laws and industry best practices.

IN WITNESS WHEREOF, the parties, intending to be legally bound, have each executed this agreement as of the effective date.

Signed, sealed and delivered on behalf of Auditor

Name: [INSERT NAME OF SIGNING AUTHORITY /COMPANY AND/OR DESIGNATION]

Signature:

Date: [INSERT THE DATE ON WHICH COMPANY SIGNS THE AGREEMENT]

Signed, sealed and delivered on behalf of Company

Name: [INSERT NAME OF SIGNING AUTHORITY /AUDITOR AND/OR DESIGNATION]

Signature: 

Date: [INSERT THE DATE ON WHICH AUDITOR SIGNS THE AGREEMENT]