CIS Network and Web App Pen Testing Terms and Conditions

The following terms and conditions apply to the penetration testing services provided by Center for Internet Security, Inc. (“CIS”) to the customer (“Customer”).

1. CIS Obligations. CIS will provide the services described in these terms and conditions (the “Agreement”) and in a Statement of Work (the “SOW”) issued by CIS to Customer, which is hereby incorporated and made a part of this Agreement, along with any applicable CIS Order (the “Services”). Any other cybersecurity monitoring or assessment or additional consulting services will be the subject of a separate written agreement.
2. Customer Obligations. Customer is responsible for selecting the penetration testing service, or combination of services, that best meet its needs. Customer also agrees to provide specific external Internet Protocol (IP) addresses and domains as requested by CIS.

   Customer agrees to have a person available at all times during the penetration testing engagement to restore, as soon as possible, any service or server that becomes unavailable.

3. Pricing Assumptions; Scope Changes. Customer agrees to pay CIS a fee as detailed in the SOW (the “Fee”). The Fee is based on the scope, assumptions, and information provided by Customer. If, before or during performance of the Services, CIS reasonably determines that any such information or assumptions are materially inaccurate, incomplete, changed, or that substantial additional scope, time, or effort will be required to complete the penetration testing as intended, CIS will promptly notify Customer.

   In such event, the Parties will in good faith agree on an appropriate adjustment to the Fee, timeline, and/or any other elements in the SOW that require adjustment. Customer agrees to pay CIS any additional fees agreed upon as a result of such changes (an “Overage Fee”). CIS is not required to perform work beyond that described in the previously-agreed SOW unless and until the Parties agree to applicable adjustments in writing (email sufficient).

4. Payment Terms. CIS will issue an invoice listing the Fee, along with any applicable taxes (the “Invoice”). Customer agrees to pay the Invoice within thirty (30) days of the Invoice date. Notwithstanding the foregoing, the Invoice must be paid in full before CIS provides any Services under this Agreement and CIS has no obligation to incur any costs or expenses, including but not limited to prepaid travel expenses, if any, until the Invoice has been paid. Additional payment terms, if any, are set forth in the applicable Invoice.

   If the Parties have agreed to an Overage Fee, Customer shall pay CIS such Overage Fee in full, no later than thirty (30) days after the date of the invoice.

5. Confidentiality Obligations. In connection with performing the Services, certain confidential or proprietary information may either be provided by Customer to CIS or generated in the performance of the Services including, without limitation: information regarding the infrastructure and security of Customer’s information systems; the results of the penetration testing of Customer’s information systems insofar as those results may reveal specific vulnerabilities; any systems assessments and plans that relate specifically and uniquely to the vulnerability of Customer’s information system; or any other document or data otherwise marked as confidential by Customer as “Confidential” (“Confidential Information”). CIS agrees to keep Customer’s Confidential Information in confidence to the same extent and the same manner as CIS protects its own confidential information, but in no event will less than reasonable care be provided and Customer’s Confidential Information will not be released in any identifiable form without the express written permission of Customer or as required pursuant to lawfully authorized subpoena or similar compulsive directive or is required to be disclosed by law, provided that CIS shall be required to make reasonable efforts, consistent with applicable law, to limit the scope and nature of such required disclosure. CIS shall, however, be permitted to disclose relevant aspects of such Confidential Information to its employees and CIS's third-party Cyber Security Services partners including federal partners provided that they agree to protect the Confidential Information to the same extent as required under this Agreement. CIS further agrees to use reasonable steps to ensure that Confidential Information received under this Agreement is not disclosed in violation of this Section. These confidentiality obligations shall survive the termination of this Agreement.
   
   Customer specifically acknowledges that as part of the Services it will require the CIS Penetration Testing Team (PTT) to view machine configuration data. CIS agrees that its PTT will avoid intentional view or transfer of any customer and user data. Customer further acknowledges that if sniffers are used as part of the Services, it is possible that customer and/or user data will be captured. CIS agrees that should any personal data be captured, it will destroy any personal data captured and will not review it.
   
6. Limitation of Liability.  It is understood and agreed by Customer that there is an element of risk associated with penetration testing activities, especially to the systems tested in a live environment. This risk includes the potential that some services on Customer’s system may be rendered unavailable during the test process. Although this risk is mitigated by the use of experienced professional penetration testers and the use of tools obtained from trusted resources, it can never be fully eliminated. It is further understood and agreed by Customer that there is no guarantee that every vulnerability in its systems will be identified during the test.
   CIS DOES NOT ASSUME ANY RESPONSIBILITY OR LIABILITY FOR ANY ACT OR OMISSION OR OTHER PERFORMANCE RELATED TO THE SERVICES, INCLUDING ANY ACT OR OMISSION BY CONTRACTORS OR SUBCONTRACTORS OF CIS, OR FOR THE ACCURACY OF THE INFORMATION PROVIDED AS PART OF THE SERVICES. THE SERVICES ARE PROVIDED ON AN “AS-IS” BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED.
   
   If for any reason CIS fails to perform Services required under the Agreement, CIS’s liability shall be limited SOLELY to the return of a pro rata portion of any consideration paid for any Services not performed.
   
7. Termination. Either Party may terminate the Services in the event that the other Party materially breaches this Agreement and such breach is not corrected within 30 days of receipt of written notice of such breach.
8. Force Majeure. Neither Party shall be liable for performance delays or for non-performance due to causes beyond its reasonable control.
9. Relationship of the Parties. Nothing in this Agreement creates an employment relationship, agency, joint venture or partnership between the Parties. Neither Party is authorized to make any representation or commitment on behalf of the other Party without its prior written consent. Each Party shall be responsible for its own employees, contractors and agents.
10. Governing Law. Unless otherwise specifically prohibited by the laws of Customer’s jurisdiction, any disputes arising in connection with the Services or this Agreement shall be governed and interpreted by the laws of the State of New York without regard to its conflict of law provisions. In the event that the laws of Customer’s jurisdiction require that the laws of that jurisdiction apply to all contracts entered into by Customer, then the laws of that jurisdiction shall apply.
11. Entire Agreement. This Agreement, including all incorporated documents, constitutes the entire agreement between CIS and Customer with respect to the Services, superseding any prior representations, discussions, negotiations or other agreement, whether written or oral, between the Parties. Except as otherwise expressly stated, in the event that there is a conflict between the terms of Customer’s SOW and the Agreement, the conflicting provisions in the Agreement shall prevail.
12. Waiver and Severability of Terms. The failure of either Party to exercise or enforce any right or provision of this Agreement shall not constitute a waiver of such right or provision. If any provision of t this Agreement is found by a court of competent jurisdiction to be invalid, the parties nevertheless agree that the court should endeavor to give effect to the parties' intentions as reflected in the provision, and the other provisions of this Agreement remain in full force and effect.

Contract Version Date: 07/24/2026