SECURITY ADDENDUM (ENTERPRISE SAAS)

TABLE OF CONTENTS

1. Scope and Order of Precedence
2. Security Program
3. Access Controls and Authentication
4. Encryption
5. Network and Infrastructure Security
6. Application Security and SDLC
7. Vulnerability Management
8. Logging and Monitoring
9. Business Continuity and Disaster Recovery
10. Data Segregation and Residency
11. Penetration Testing and Assessments
12. Incident Response and Notification
13. Audit and Compliance Reports
14. Third-Party Subprocessors
15. Physical Security
16. Personnel Security and Training
17. Data Return and Deletion
18. Changes to Security Controls

1. SCOPE AND ORDER OF PRECEDENCE

• Applies to the Services under the [SaaS Agreement name/date].
• If conflict with the SaaS Agreement/DPA on security matters, this Addendum governs; otherwise, SaaS Agreement controls.

2. SECURITY PROGRAM

• Provider maintains a written information security program with administrative, technical, and physical safeguards appropriate to risk, aligned to [ISO 27001/SOC 2/other].

3. ACCESS CONTROLS AND AUTHENTICATION

• Role-based access; least privilege; MFA for administrative access; strong password/secret policies; session management; timely deprovisioning.

4. ENCRYPTION

• In transit: TLS [1.2/1.3] or better; at rest: industry-standard encryption for Customer Data stores.
• Key management: [KMS/HSM], separation of duties, rotation policies.

5. NETWORK AND INFRASTRUCTURE SECURITY

• Segmentation of environments (prod/non-prod); firewalls/security groups; DDoS protections; hardened images; configuration management and baselines.

6. APPLICATION SECURITY AND SDLC

• Secure development lifecycle with code review, dependency scanning, SAST/DAST for relevant components; change management with approvals and rollback plans.

7. VULNERABILITY MANAGEMENT

• Regular scanning; prioritization/remediation targets:
• Critical: [X] hours/days; High: [Y] days; Medium: [Z] days; Low: [define].
• Patch management process; emergency patching for exploited vulnerabilities.

8. LOGGING AND MONITORING

• Centralized logging for auth, access, admin actions, and security events; time-synchronized; retention [X] days/months; alerting for anomalous events.

9. BUSINESS CONTINUITY AND DISASTER RECOVERY

• Documented BC/DR plan; tested [annually/semi-annually]; RPO [X hours], RTO [Y hours]; backups encrypted and tested for restoration.

10. DATA SEGREGATION AND RESIDENCY

• Logical/tenant isolation; data residency options [Regions] if offered; no relocation without notice and updated transfer mechanisms.

11. PENETRATION TESTING AND ASSESSMENTS

• Independent penetration tests [annually/semi-annually]; summary reports available under NDA; remediation tracked to closure.
• Customer-sourced testing requires prior written approval and coordinated scope.

12. INCIDENT RESPONSE AND NOTIFICATION

• Incident response plan with roles, runbooks, and communications.
• Notification to Customer without undue delay and within [X] hours of confirming a Security Incident affecting Customer Data; include nature, scope, mitigations, and recommended actions.
• Post-incident report for material incidents within [Y] business days.

13. AUDIT AND COMPLIANCE REPORTS

• Provide current SOC 2 / ISO 27001 certificate and summary upon request; significant exceptions disclosed with remediation plans.
• Onsite/customer audits: [once per year] with reasonable notice; subject to confidentiality and limited to security controls; time/materials fees if onsite.

14. THIRD-PARTY SUBPROCESSORS

• Subprocessors must meet equivalent security standards; list available at [URL/Annex]; notice of new subprocessors with [X] days to object on reasonable grounds; Provider remains liable.

15. PHYSICAL SECURITY

• Data centers with industry-standard controls: access badges/biometrics, CCTV, visitor logging, environmental controls, and redundant power/cooling.

16. PERSONNEL SECURITY AND TRAINING

• Background checks where lawful for personnel with Customer Data access; confidentiality agreements; security and privacy training at onboarding and [annual] refreshers.

17. DATA RETURN AND DELETION

• Upon termination/expiry, Customer Data returned or deleted per Agreement/DPA within [X] days; secure deletion methods; backups aged out on standard cycles unless legal hold applies.

18. CHANGES TO SECURITY CONTROLS

• Material reductions not permitted without Customer consent; non-material updates allowed to improve or maintain security posture.
• Notice of material changes to contact [security contact].