Terms and Conditions for Arcanum Information Security Limited

Definitions

In these Terms and Conditions, the following words shall have the following meanings:

Arcanum means Arcanum Information Security Limited.

Client means the individual or organisation that purchases Services from Arcanum.

Supplier Arcanum Information Security Ltd, a company registered in England and Wales with company number 06567907 and registered office at Ty Penywaun Mountain Road, Bedwas, Caerphilly, Wales, CF83 8ER.

Business Day 09.00 to 17.30 on any day (other than a Saturday, Sunday or a public holiday) when banks in London are open for business.

Services means the services provided by Arcanum, including but not limited to Governance, Risk, and Compliance (GRC), Cyber Security Architecture, Assurance, Incident Management, Penetration Testing, Operational Technology (OT) Security, and Cyber Essentials Certifications.

Deliverables The deliverables set out in the Statement of Work.

Confidential Information means any information, in any form, which is confidential to either Party and is obtained under or in connection with these Terms and Conditions.

Force Majeure Event An occurrence beyond reasonable control and without the fault or negligence of the Party affected and which the said Party is unable to prevent or provide against by the exercise of reasonable diligence, including but not limited to:

I. Acts of God (such as fires, explosions, earthquakes, drought, tidal waves and floods or other catastrophes)
II. War, hostilities, invasion, act of foreign enemies, mobilisation, requisition or embargo.
III. Civil war, rebellion, revolution, or insurrection
IV. Terrorist attacks or threats of terrorist attacks
V. Government actions, laws, or regulations
VI. Strikes, lockouts, or other industrial action
VII. Widespread power failures or telecommunications breakdowns
VIII. Pandemics or epidemics

If a Force Majeure Event prevents the Supplier from providing any of the Services and/or Goods, or the Client from complying with any of its obligations for more than fourteen (14) days, either Party shall, without limiting its other rights or remedies, have the right to terminate the Contract immediately by giving written notice to the other Party as per clause 10.

Parties means Arcanum and the Client collectively, and “Party” means either Arcanum or the Client individually.

Proposal The costed proposal and/or quotation (exclusive of VAT unless otherwise stated) defining the proposed delivery of the Services and the associated fees, as agreed between the Parties, and which forms part of the Contract between the Parties.

Intellectual Property Rights All patents, rights to inventions, utility models, copyright and related rights, trademarks, service marks, trade, business and domain names, rights in trade dress or get-up, rights in goodwill or to sue for passing off, unfair competition rights, rights in designs, rights in computer software, database right, topography rights, moral rights, rights in confidential information (including know-how and trade secrets) and any other intellectual property rights, in each case whether registered or unregistered and including all applications for and renewals or extensions of such rights, and all similar or equivalent rights or forms of protection in any part of the world. In the context of cybersecurity services refers to valuable intangible assets created by the mind that require protection from unauthorised access, use, or theft in the digital realm.

Statement of Work The document detailing the supply of Services, as agreed between the Parties, and which forms part of the Contract between the Parties.

Penetration Testing, (also known as pen testing or ethical hacking), means an authorised simulated cyberattack on a computer system, network, or web application performed to evaluate its security.

Operational Technology (OT) means consulting services providing expert guidance and support to organisations in managing, securing, and optimising their industrial control systems and critical infrastructure. These services encompass:

Key Components

I. Assessment and Strategy

• Evaluating existing OT environments
• Developing comprehensive OT security strategies
• Conducting risk assessments and vulnerability analyses

II. Security Implementation

• Designing and implementing OT security architectures
• Deploying security controls and technologies
• Establishing incident response and recovery plans

III. Compliance and Governance

• Ensuring adherence to industry standards and regulations
• Developing OT security policies and procedures
• Implementing governance frameworks for OT environments

IV. Integration and Convergence

• Facilitating IT/OT convergence
• Integrating OT systems with enterprise IT infrastructure
• Implementing secure remote access solutions

V. Training and Awareness

• Providing OT security awareness training
• Developing skills for OT personnel in security best practices
•  

Services Order is a formal document also known as a Statement of Work that outlines the specific services to be provided by the Supplier to a Client. It serves as a short-term agreement between the two Parties and contains essential details about the requested service.

Client Prerequisites essential conditions, requirements, or qualifications that Clients must meet or possess before engaging in a business relationship or receiving services from Arcanum. These prerequisites serve to establish a foundation for effective collaboration and ensure that both Parties are well-aligned for a successful partnership.

Contract means a legally binding agreement incorporating these Terms and Conditions between the Client, the Supplier and any other parties, establishing the rights, obligations, and rules governing their business relationship.

Governance, Risk and Compliance (GRC) is a comprehensive framework that integrates three key components to ensure effective management of an organisation’s digital assets and information security. GRC in cyber security services aims to create a unified approach that enhances an organisation’s security posture, improves operational efficiency, and supports informed decision-making. By integrating these three components, organisations can better protect their digital assets, maintain operational integrity, and build resilience against cyber threats.

Social Engineering Testing, in the context of the Communications Act 2003, is a security assessment technique used to evaluate an organisation’s vulnerability to social engineering attacks. It involves simulating real-world social engineering scenarios to test how employees and systems respond to potential threats.

Wireless Network Testing means the process of evaluating and assessing the performance, security, and compliance of wireless electronic communications networks.

Information Standards are guidelines and criteria that organisation’s implement to protect sensitive and confidential information. These standards aim to ensure the security, integrity, and proper handling of personal data.

2.      Provision of Services

2.1. Arcanum shall provide the Services with reasonable skill and care, in accordance with industry standards and best practices.

2.2. The Client shall provide Arcanum with all necessary access, information, and cooperation required to perform the Services.

2.3.    For Penetration Testing services:

2.3.1. The Client grants Arcanum explicit permission to attempt to breach security controls and gain unauthorised access to the Client’s systems for the purposes of lawfully and legitimately undertaking the agreed testing procedures as defined in the Statement of Works.
2.3.2. The Client warrants that it has obtained all necessary authorisations from third parties to allow Arcanum to perform testing on systems not owned by the Client.
2.3.3. Arcanum shall not intentionally perform any denial of service (DoS) testing without prior written agreement.

3.      For Operational Technology (OT) consulting services:

3.1. The Client grants Arcanum explicit permission and method to access and review relevant documentation to facilitate OT services documented in SOW.
3.2. The Client warrants that it has obtained all necessary authorisations from third parties to allow Arcanum to perform its services. The project’s scope will be limited to the infrastructure and locations identified above.
3.3. Any changes to this scope may impact assessed project delivery resources.

4.      Client Responsibilities

4.1. The Client is responsible for selecting the appropriate Services to meet its needs.
4.2. The Client shall ensure that only authorised personnel have access to Arcanum’s services and systems.
4.3. The Client shall be responsible for the legality of using the Services in jurisdictions outside the United Kingdom.

5.      Confidentiality

5.1. Each Party shall keep confidential all Confidential Information obtained from the other Party and shall not disclose such information without the prior written consent of the other Party.
5.2. Arcanum shall securely store all Client data and testing results in accordance with applicable data protection laws.

6.      Intellectual Property

6.1. All Intellectual Property Rights in the Services and any materials produced by Arcanum shall remain the property of Arcanum.
6.2. The Client shall not reproduce, modify, or distribute any of Arcanum’s materials without prior written consent unless required by law or any regulatory body to which the Client is subject.
6.3. The Supplier shall not reproduce, modify or distribute any of the Client’s data or materials without prior written consent unless required by law.

7.    Indemnity

7.1. The Supplier shall indemnify the Client against all losses, damages, costs or expenses incurred by, awarded against the Client arising from:

7.2. any breach of data protection.

7.3. any breach of confidentiality.

This clause 7 shall survive termination of the Contract.

8.      Limitation of Liability

8.1. Nothing in these Terms and Conditions shall limit or exclude Arcanum’s liability for:

a. death or personal injury caused by its negligence, or the negligence of its employees, agents or subcontractors;

b. fraud or fraudulent misrepresentation by it or its employees;

c. breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982 (title and quiet possession);

d. breach of clause 9 (Confidentiality);

e. material loss of data or damage to Client systems due to negligence or malicious action on the part of Supplier employees, agents or subcontractors

f. any other act or omission which may not be limited under applicable law; or

g. death, personal injury, fraud, or any other liability that cannot be legally limited.

8.2. Subject to clause 8.1, Arcanum’s total liability to the Client in respect of all other losses arising under or in connection with the Contract, whether in contract, tort, breach of statutory duty or otherwise, shall not exceed the total fees paid by the Client for the Services in the 12 months preceding the event giving rise to the claim.

8.3. Arcanum shall not be liable for any indirect, consequential, or special losses, including but not limited to loss of profits, revenue, or business opportunities.

8.4. Except as set out in these conditions, all warranties, conditions and other terms implied by statute or common law are, to the fullest extent permitted by law, excluded from the Contract.

9.      Warranties and Disclaimers

9.1. Arcanum does not warrant that the Services will identify all vulnerabilities or security issues in the Client’s systems.

9.2. The Client acknowledges that the Services may impact, disrupt, or damage information systems and data, and Arcanum shall not be held responsible for such consequences when performed within the agreed scope of work unless due to negligence or malicious action on the part of Supplier employees, agents or subcontractors.

10. Termination

10.1. The Client shall be entitled to cancel the Services Order and/or claim reimbursement for actual losses and expenses suffered if:

a. The Supplier fails to deliver the Services in accordance with the terms of the Proposal and Statement of Work; or

b. The Supplier fails to rectify defective work within the timescale agreed in writing between the Client and The Supplier; or

c. The performance of The Supplier is demonstrably below normal industry standards for the type of Service.

10.2. Without prejudice to all the Client’s rights and remedies at law the Supplier will repair or replace at the Client’s request and in a reasonable time frame any defective item delivered by the Supplier. A defective item is one which does not comply with agreed acceptance criteria. The Client shall set out in writing to the Supplier, the nature of any supposed defective items.

10.3. The Supplier will investigate defective items on request by the Client and will provide the Client with a written report describing the cause or causes of such defects and setting out details of corrective action, which will prevent recurrence.

10.4. The Client shall warrant that all costs and expenses reasonably incurred by the Supplier due to carrying out the requested investigation where items turn out not to be defective will be fully paid by the Client.

10.5. Either Party may terminate this agreement if the other Party breaches any material term of this agreement, after giving written notice to the other Party of such breach or breaches and allowing reasonable time for remediation of such breach or breaches.

10.6. Upon termination, the Client shall immediately cease using any of Arcanum’s services, equipment, or licensed technology.

11. Supplier Obligations

11.1. The Supplier shall provide the Services to the Client in accordance with the Proposal and Statement of Work in all material respects. In providing the Services, the Supplier will always:

a. provide the Services and perform its obligations in accordance with good industry practice.

b. comply with all applicable laws and notify the Client of any proposed changes in applicable laws that the Supplier becomes aware of that may affect the provision of the Services by the Supplier to the Client.

c. perform the Services in a timely, reliable and professional manner, in conformity with good industry practice by a sufficient number of competent Supplier personnel with appropriate skills, qualifications and experience, and have the ability and capacity to meet such requirements.

11.2. The Supplier shall use reasonable endeavours to meet any performance dates for the Services specified in the Statement of Work, but any such dates shall be estimates only and time shall not be of the essence for the performance of the Services unless otherwise agreed in writing.

11.3. The Supplier shall have the right to make any changes to the Services which are necessary to comply with any applicable law or safety requirement, or which do not materially affect the nature or quality of the Services, and the Supplier shall notify the Client in writing in any such event.

12. Client Obligations.

The Client shall:

a. ensure that the terms of the Proposal and Statement of Work are complete and accurate.
b. co-operate with the Supplier in all matters relating to the Services.
c. provide the Supplier, its employees, agents, consultants and subcontractors, with access to the Client’s premises, office accommodation and other facilities as reasonably required by the Supplier to provide the Services and maintain a safe working environment for the Supplier in such facilities that complies with all applicable legislative requirements (including occupational, health and safety laws and regulations).
d. provide the Supplier with such information and materials as the Supplier may reasonably require supplying the Services and ensure that such information is accurate in all material respects.
e. prepare the premises for the supply of the Services.
f. obtain and maintain all necessary licences, permissions and consents which may be required for the Services before the date on which the Services are to start.
g. keep and maintain all materials, equipment, documents and other property of the Supplier (Supplier Materials) at the Client’s premises in safe custody at its own risk, maintain the Supplier Materials in good condition until returned to the Supplier, and not dispose of or use the Supplier Materials other than in accordance with the Supplier’s written instructions or authorisation.

12.1. If the Supplier’s performance of any of its obligations in respect of the Services is prevented or delayed by any act or omission by the Client or failure by the Client to perform any relevant obligation and on written notice to the Client to such effect, providing reasonable opportunity for the Client to remediate the identified act or omission (Client Default):

12.2. the Supplier shall without limiting its other rights or remedies have the right to suspend performance of the Services until the Client remedies the Client Default, and to rely on the Client Default to relieve it from the performance of any of its obligations to the extent the Client Default prevents or delays the Supplier’s performance of any of its obligations.

12.3. The Supplier shall not be liable for any costs or losses sustained or incurred by the Client arising directly or indirectly from the Supplier’s failure or delay to perform any of its obligations as set out in this clause arising from the Client Default; and

12.4. The Client shall reimburse the Supplier on written demand for costs or losses, up to the value of the goods and services provided by the Supplier, sustained or incurred by the Supplier arising directly from the Client Default.

13. Sub-Contract, Assignment and Significant Changes

13.1. The Supplier may at any time assign, transfer, novate, charge, subcontract or deal in any other manner with all or any of its rights or obligations under the Contract to any third party, subject to written approval in advance by the Client.

13.2. The Client shall not, without the prior written consent of the Supplier, assign, transfer, novate, charge, subcontract or deal in any other manner with all or any of its rights or obligations under the Contract.

13.3. The Parties shall always remain responsible for the acts and omissions of their subcontractors.

13.4. On receipt of written notice of any proposed change to the provider of the Services or to the Services or to the manner of delivery of the Services (a “Significant Change”) the Client shall be entitled to review the likely effect(s) of the Significant Change(s) upon the delivery of the Services and/or the Client’s relevant business or operations and/or the quality of the Services to be delivered (each a “Relevant Matter”). The Supplier agrees to promptly provide all reasonable assistance to the Client to assist the Client in its said review and to address the Client’s reasonable concerns arising there from.

13.5. The Client shall be entitled to suspend the Statement of Work for a reasonable period without liability where a Significant Change has a material effect on any Relevant Matter (a “Material Impact”). Also, at any time during or after its said review the Client may notify the Supplier in writing of the reason(s) it considers the Significant Change to have or be likely to have a Material Impact. the Client may terminate (without prejudice to any of its other rights) the Statement of Work forthwith without liability to the Supplier if the Supplier fails:

a. to demonstrate (within 30 days of such notification) that the Significant Change does not and/or will not have a Material Impact; or

b. to conclude (in such period) alternative arrangements acceptable to the Client, with all material communications on the matter between the Parties to be conducted in writing.

13.6. Because of the nature of the work to be undertaken by the Supplier, both Parties accept that it may be necessary to agree to alter or adapt the Services and that any additional works required may not be included in the Consultancy Fee detailed in the Statement of If the Supplier estimates that these additional works will cause an increase in Consultancy Fee or delay in completion of the work, he shall notify the Client in writing. The Parties accept that any changes or additions to the Statement of Work shall be valid only if agreed in writing by the Supplier and the Client.

14. Suspension

14.1. In the event of any interruption of the Client’s or of the Suppliers business due to circumstances beyond each Party’s control such as but not limited to any industrial dispute, fire explosion or accident which would prevent or hinder the use of goods or work which is the subject of the Statement of Work both the Client and the Supplier shall have the right to suspend the Services until such circumstances have ceased.

14.2. If the Client causes delays to the project which are not reasonably deemed unforeseen business circumstances, the Supplier reserves the right to pause the work and postpone it to a later date, to accommodate other prebooked client work.

15. Methods, Tools, materials and/or equipment

15.1. The Supplier shall provide any equipment and/or tools and/or materials necessary for the provision of the Services.

16. Basic Agreement

16.1. The Contract constitutes the entire agreement between the Client acknowledges that it has not relied on any statement, promise or representation made or given by or on behalf of the Supplier which is not set out in the Contract.

16.2. No amendments may be made to the Contract except with the written agreement of both Parties.

16.3. Any reports, drawings, descriptive matter or advertising issued by the Supplier and any illustrations or descriptions of the Services contained in the Supplier’s catalogues or brochures are issued or published for the sole purpose of giving an approximate idea of the Services described in them. They shall not form part of the Contract or have any contractual force. The only binding documents/artefacts are these Conditions, the Statement of Work and others specifically referred to within it.

16.4. These Conditions apply to the Contract to the exclusion of any other terms that the Client seeks to impose or incorporate, or which are implied by trade, custom, practice or course of dealing.

16.5. Any quotation given by the Supplier shall not constitute an offer and is only valid for a period of thirty (30) days from its date of issue.

17. Charges and Payment

17.1. The charges for Services shall be set out in the Proposal and/or quotation or, if no charges are quoted, the default position will be that the Services are charged on a time and materials basis:

a. the charges shall be calculated in accordance with the Supplier’s standard daily fee rates, as set out in the Proposal or quotation.

b. the Supplier’s standard daily fee rates for each individual person are calculated based on a normal Business Day.

c. by prior written agreement with the Client, the Supplier shall be entitled to charge overtime for any time worked by individuals whom it engages on the Services on a pro-rata basis as follows:

I. Fifty per cent (50%) uplift on the standard daily fee rate for time worked outside the defined hours of a normal Business Day; and

II. One hundred per cent (100%) uplift on the standard daily fee rate for time worked on a non- Business Day.

17.2. The treatment of expenses (if applicable) will be set out in the Statement of Work. In the absence of any detailed expenses process in the Statement of Work, the default position will be that the Supplier shall be entitled to charge the Client for any reasonable expenses incurred by the individuals whom the Supplier engages in connection with the Services including, but not limited to, travelling expenses, hotel costs, subsistence and any associated expenses, and for the cost of services provided by third parties and required by the Supplier for the performance of the Services, and for the cost of any materials, subject to the production of receipts supporting such expenses which the Supplier seeks to recover. If a cap on expenses has been agreed in the Statement of Work, and if it becomes apparent that such expenses will necessarily exceed pre-agreed limits, written approval will be sought from the Client.

17.3. The Supplier reserves the right to:

i) Increase the price of the Services, by giving notice and full written justification to the Client at any time before delivery, and subject to written consent of the Client, not to be unreasonably withheld, to reflect any increase in the cost of the Services to the Supplier that is due to:

i. Any factor beyond the control of the Supplier (including foreign exchange fluctuations, increases in taxes and duties, and increases in labour, materials and other manufacturing costs).

ii. Any request by the Client to change the delivery date(s), quantities or types of Services ordered, or the Services Specification; or

iii. Any delay caused by any instructions of the Client in respect of the Services or failure of the Client to give the Supplier adequate or accurate information or instructions in respect of the Services.

17.4. The default invoicing position will be:

a. With respect to Support Services, the Supplier shall invoice the Client annually in advance; and

b. With respect to other Services, the Supplier shall invoice the Client monthly in arrears for work actually performed or completed work items.

17.5. The Client shall pay each invoice submitted by the Supplier:

a. Within thirty (30) days of the date of the invoice.

b. In full and in cleared funds to a Pound Sterling bank account nominated in writing by the Supplier; and

c. time for payment shall be of the essence of the Contract.

17.6. All amounts payable by the Client under the Contract are exclusive of amounts in respect of value added tax (VAT) chargeable from time to time.

17.7. Where a scheduled Client Service as accepted by the Client and the Statement of Work is cancelled or postponed for reasons outside of the Supplier’s control, the Supplier reserves the right to charge a postponement or cancellation fee on the following basis:

a. Postponement or Cancellation less than five (5) working days’ notice of scheduled commencement of service delivery: 100% of proposed fee for the affected component of work.

b. Postponement or Cancellation between five (5) and ten (10) working days’ notice of scheduled commencement of service delivery: 50% of proposed fee for the affected component of work.

17.8. In the event that the Supplier attempts to contact the Client regarding the project scheduled to commence, and the Client fails to respond or communicate with the Supplier via email or telephone within a reasonable timeframe, within 48 working hours prior to the agreed work commencement date, the Supplier shall be entitled to treat the Contract as repudiated by the Client’s conduct, subject to providing written notice to the Client and permitting the Client to take reasonable steps to explain or remediate the circumstances leading to their failure to respond or communicate. In such circumstances, the Supplier may, at its discretion and acting reasonably, terminate the Contract and claim damages for breach, including but not limited to:

a. Any costs incurred in preparation for the project

b. Loss of profit on the Contract

c. Any other reasonably foreseeable losses arising from the Client’s breach

d. Postponement or Cancellation less than five (5) working days’ notice of scheduled commencement of service delivery: 100% of proposed fee for the affected component of work.

17.9. The specific charges to be applied shall be outlined in the Contract terms and must be a genuine pre-estimate of the loss likely to be suffered by the Supplier as a result of the Client’s breach.

17.10. If the Client fails to provide the required prerequisites to the Supplier within five (5) working days ahead of the scheduled work commencement date, the Supplier reserves the right to consider the work cancelled and charge the Client as follows:

a. Postponement or Cancellation less than five (5) working days’ notice of scheduled commencement of service delivery: 100% of proposed fee for the affected component of work.

17.11. In the event that the Supplier has commenced delivery of services but is unable to proceed due to the Client’s failure to specify work activities in a timely manner, the Supplier reserves the right to charge for these unactive days. The Client acknowledges that such delays may result in idle time for the Supplier’s resources, which have been allocated and reserved for the project. To mitigate financial losses and ensure fair compensation, the following conditions apply:

a. The Supplier will notify the Client in writing when work cannot proceed due to lack of specified activities.

b. The Client will be given a reasonable timeframe, as defined in the project schedule, to provide the necessary information or specifications.

c. If the Client fails to provide the required information within the specified timeframe, the Supplier may, at its discretion, charge for unactive days at a rate of 100% of the agreed daily rate.

d. These charges will be applied to the next invoice and clearly itemised as “Unactive Days Due to Client Delay.”

e. The Client agrees to pay these charges as part of the regular payment terms outlined in this agreement.

f. The Supplier will make reasonable efforts to reallocate resources during such delays to minimise charges, where possible.

By agreeing to these terms, the Client acknowledges the importance of timely communication and specification of work activities to ensure efficient project delivery and avoid unnecessary costs.

17.12. Without limiting any other right or remedy of the Supplier, if the Client fails to make any payment due to the Supplier under the Contract by the due date for payment, the Supplier shall have the right to charge interest on the overdue amount at the rate of three per cent (3%) per annum above the Barclays base rate from time to time. Such interest shall accrue on a daily basis from the due date until actual payment of the overdue The Customer shall pay the interest together with the overdue amount.

17.13. The Client shall pay all amounts due under the Contract in full without any deduction or withholding except as required by law and the Client shall not be entitled to assert any credit, set-off or counterclaim against the Supplier in order to justify withholding payment of any such amount in whole or in part. The Supplier may not, without limiting its other rights or remedies, set off any amount owing to it by the Client against any amount payable by the Supplier to the Client.

18. Governing Law and Jurisdiction

18.1. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales.

18.2. Any disputes arising out of or in connection with these Terms and Conditions shall be subject to the exclusive jurisdiction of the courts of England and Wales.

By engaging Arcanum’s services, the Client acknowledges that they have read, understood, and agreed to these Terms and Conditions.

19. Health and Safety at Work Act 1974

19.1. In accordance with the requirements of the health and safety at work act 1974 and any re-enactment or amendment thereof, any safety precautions required for the handling of the material covered by the Statement of Work are to be clearly indicated on each consignment by the consignee.

20. Computer Misuse Act 1990

20.1. Under the Computer Misuse Act 1990 it is an offence to gain unauthorised access to a computer system or to make unauthorised modifications to computer data. Prior to the start of any testing, the Supplier will ensure that written authorisation is obtained from Client organisations whose computers and networks may be affected during the testing. This authorisation will include details of the test dates and scope.

20.2. It is the Client’s duty to inform any third-party (for example, cloud, system or application hosting providers) systems or networks that may be affected by the testing and as such the Client shall indemnify the Supplier against any claim arising from a third-party relating to the Penetration Testing where such claim is not due to negligent or malicious action on the part of the Supplier or its employees, agents or subcontractors..

21. Human Rights Act 1998

21.1. In compliance with the Human Rights Act 1998, the Supplier shall make all reasonable endeavours to ensure that an individual’s privacy is respected, where applicable. As such the Supplier shall ensure that personal and sensitive data is only collected and retained with agreement of the individual and specifically as part of the test requirements or Where the Client has already informed its employees that they have no right to privacy on Client systems and that email may be monitored, then the Client shall indemnify the Supplier against any claims arising.

22. Regulation of Investigatory Powers Act 2000

22.1. The Regulation of Investigatory Powers Act covers the interception or discovery of data on any electronic medium. During the course of testing Penetration testers may identify network traffic or data indicating inappropriate or illegal activities by the Client’s staff.

22.2. Should the Client take disciplinary or legal action against employees as a result of such findings then the Client shall indemnify the Supplier against any resulting breach of the Regulation of Investigatory Powers Act.

23. Communications Act 2003

23.1. The Communications Act makes the interception of wireless signals an offence unless authorised. Where Wireless Network Testing and Social Engineering Testing is within the scope of the Statement of Work then the Client hereby grants authorisation to radio frequency interception and as such indemnifies the Supplier against any action under the Communications Act 2003.

24. Malicious Communications Act 1998

24.1. Where social engineering is included within the Statement of Work, e-mails or other electronic communications sent as part of the engagement may be deemed by recipients to fall within the terms of the Malicious Communications Act The Client shall indemnify the Supplier against any action by the Client or their staff under this act for actions carried out as part of an authorised social engineering test.

25. Data Protection Act 2018 / EU General Data Protection Regulations 2018

25.1. Any information and data provided by the Client to the Supplier and used by the Supplier directly or indirectly in the performance of this Agreement shall remain at all times the property of the Client. It shall be identified, clearly marked and recorded as such by the Supplier on all media and in all documentation.

25.2. The Supplier shall take all reasonable precautions to preserve the integrity and prevent any corruption or loss, damage or destruction of the Client data and information.

25.3. In compliance with the Data Protection Act 2018, any personal information pertaining to an individual that is discovered during the course of the testing will be treated in confidence and destroyed once the commercial need for its retention has ended, this is usually marked by the delivery of the report to the Client, although where Clients request year on year comparisons of test data, such data may be securely retained in line with agreed data retention requirements. Such information will be appropriately protected throughout the course of its retention.

25.4. In the event of termination of this Agreement the Supplier shall when directed to do so by the Client, and instruct all its agents and sub-contractors to, erase all information and data provided by the Client and all copies of any part of the information and data provided by the Client from the Supplier’s systems and magnetic data.

25.5. All personal data acquired by Arcanum from the Client shall only be used for the purposes of this Agreement and shall not be further processed or disclosed without the consent of the Client. The Supplier makes use of Amazon hosted information systems for storage of project and company data, within the Ireland region. As such, all data handled by the Supplier is stored within the European The Client hereby agrees to the use of this platform for storage of data procured during an engagement and indemnifies the Supplier against any claim arising for the storage of personal data on Supplier systems for the purposes of carrying out the Services under the terms of the Contract.

25.6. Nothing in this Agreement shall oblige the Client to disclose any information to the Supplier if it is of the view that to do so would be a breach of the Data Protection Act 2018.

25.7. In fulfilment of its obligations under Clauses 5 and 25 the Supplier will have in place and will always maintain the Information Standards which will deal comprehensively with:

a. The protection of the confidentiality, integrity and security of all and any information supplied to the Supplier by the Client.

b. The audit and accounting procedures in place to deal with the requirements of this clause.

c. The reliability and training of staff to ensure awareness of (and compliance with) their obligations under clauses 5 and 25.

d. Any other measures and procedures to ensure that the Supplier’s obligations under clauses 5 and 25 are met.

25.8. The Supplier agrees to:

• Provide the Client and/or its agents, auditors or regulators with such information and access to its premises (upon giving reasonable notice) as the Client may reasonably require satisfying itself that the Supplier is complying with the obligations referred to in this clause
• Make such application for a change in its notification and take such other steps as may be reasonably practicable to afford the Client access to information which is reasonably required by the Client in connection with or for any purpose connected with its rights and obligations under this Agreement.

25.9. The Supplier shall take all reasonable steps to ensure that all its agents, partners and sub-contractors comply with the all the provisions set out above whenever they are procession the Client information or data as part of this Agreement.

25.10. For further details, our privacy policy is available upon request which stipulates our approach to complying with Privacy regulations, how we handle personal data and the individual rights pertaining to our handling of it.

26. Freedom of Information Act 2000

26.1. The Freedom of Information Act 2000 requires public authorities to publish certain information if they receive a request to do The Act’s aim is to improve government transparency and to ensure that public authorities are held to account for their actions and decisions. The requirements of the Freedom of Information Act 2000 (where applicable to the Client) shall supersede all other rights to enforcing the confidentiality clauses, including details of contractual agreements in place between the Client and the Supplier.

27. Payment Card Industry Data Security Standard (PCI DSS)

27.1. Where any testing delivered for the Client incorporates assessment of the security of payment cards then the requirements of the latest version of the Payment Card Industry (PCI) Data Security Standard (DSS) and supplementary information on the delivery of penetration tests shall apply and be The latest version of the PCI DSS as well as the PCI Security Standards Council (SSC) guidance on the delivery of penetration tests can be found at the following URLs:

• https://pcisecuritystandards.org/document_library
• https://pcisecuritystandards.org/documents/Penetration_Testing_Guidance_March_2015.pdf

28. Insolvency

28.1. The Client shall be entitled at any time by notice in writing to The Supplier to terminate this Contract without compensation to the Supplier in respect of the terminated portion but with full payment for Services carried out but unpaid if:

• The Supplier becomes insolvent or makes any compensation or arrangement with its creditors; or
• The Supplier passes any resolution for the Supplier’s winding up; or
• Where any government or other special conditions are incorporated by reference in the Statement of Work such special conditions shall apply.

29.   Information Security

29.1. Where a security classification appears in the Statement of Work, the Supplier and the Client shall always comply with the relevant security procedures for handling classified information including those contained in any security aspects letter issued by the Client’s security officer and agreed in writing by the Supplier and which shall form part of the Service.

30. Waiver

30.1. Any concession or indulgence made by either Party shall not be considered as a waiver of that Party’s rights under the order unless specifically authorised in writing on that Party’s printed order or amendment form.