Managed EDR Service Agreement

1Parties and summary

This Managed EDR Service Agreement (the "Agreement") is made on ____________ (the "Effective Date") between Cybersecurity Network, a Florida company serving clients in all 50 states ((833) 365-7047) (the "Provider"), and ______________________ (the "Client").

Managed EDR (Endpoint Detection and Response) protects the Client's computers and servers. A small sensor on each device watches for harmful activity, and the security team monitors alerts 24 hours a day, 7 days a week.

2Services

The Provider will deliver the following for the Client:

1. Sensors. A lightweight sensor is installed and maintained on each covered Windows, macOS or Linux device. It reports programs started, file changes and network connections.
2. 24/7 monitoring. Alerts are watched around the clock, every day of the year.
3. Triage. Each alert is reviewed to separate real threats from false alarms, so the Client hears from us when action matters.
4. Response. For a confirmed threat, the team takes the actions the Client approves in Schedule A, such as stopping a harmful program, quarantining a file, or isolating a device until it is safe. Where hands are needed on the device, the team guides the Client's staff.
5. Fast notice. The Client's security contact is called or emailed within 30 minutes of a confirmed high-risk threat.
6. Reports and console. A plain-language monthly report, plus console access to view the Client's own devices and alerts.

3Client responsibilities

• Allow the sensor on every covered device and keep it running. A device without a working sensor is unprotected.
• Confirm it owns or is authorized to manage every covered device, and tell employees that company devices are monitored for security.
• Name a security contact reachable 24/7, plus a backup.
• Keep systems updated and keep backups of important data.
• Report added or retired devices within 5 business days.

Permission to respond. By signing, the Client authorizes the response actions checked in Schedule A on covered devices, without asking first, when a threat is confirmed. Every action is logged and reported.

4Fees, billing and term

Billing. Invoices are due within 15 days. Monthly plans are billed in advance. After 30 days past due, service may be paused with 10 days' written notice.

Term. The first term is 12 months, then renews month to month. After the first term, either party may cancel with 30 days' written notice.

Price changes. 30 days' written notice before any price change.

5Data, privacy and confidentiality

The sensor collects security activity only: device name, programs run, file and network activity, and alert details. It leaves the content of documents, emails and messages alone. Activity data is kept 90 days. If Client data held by the Provider is exposed, the Client is told within 72 hours.

Client data is used only to provide this service and is never sold. It is stored on access-restricted U.S. servers and sent over encrypted connections. Each party keeps the other's business information private during this Agreement and for 2 years after it ends.

6Limits of service and liability

Managed EDR greatly lowers the risk and damage of an attack. No security service can stop every threat, so detecting or stopping every attack is not guaranteed. A response action, such as isolating a device, may briefly interrupt work; the Client accepts this as part of stopping a threat.

Each party's total liability is limited to the fees paid in the 3 months before a claim. Neither party is liable for lost profits or indirect damages.

7General terms

Nationwide service. The Provider serves clients in all 50 states and Washington, D.C. Services may be delivered remotely or on site, by the Provider's team or by qualified, vetted partners bound by the same confidentiality terms.

Governing law. This Agreement is governed by the laws of the State of Florida, where the Provider is incorporated, without regard to conflict-of-law rules. Any dispute will be resolved in the state or federal courts of Florida, unless both parties agree in writing to another venue or to binding arbitration. Where the law of the Client's state requires otherwise, that law applies to the extent required.

Whole agreement. This Agreement and Schedule A are the full agreement; changes must be in writing and signed by both parties. If any part is found unenforceable, the rest stays in effect.

Assignment. Neither party may transfer this Agreement without the other's written consent, except to a successor of its business.

Independent parties. The Provider acts as an independent contractor.

Schedule A: Service details

Signatures

More sample contracts

• Monthly Managed Plan