MODEL NON-DISCLOSURE AGREEMENT
(Between CERT-In empanelled Auditor & Auditee)
THIS NON-DISCLOSURE AGREEMENT is made on this …….. day (date) of ………… (Year)
By and between
 # In case of Central Government Ministry/ Departments #/State Government Departments
President of India/Governor of (name of state) acting through ……………………………. (Name, Designation) of …………………….. (Name of Ministry/ Department) address …………………… hereinafter referred to as “Auditee”which expression shall unless repugnant to the context or meaning thereof ,include its successors and assigns)of the first part.
# In case of Autonomous Societies/ Not-for-profit companies/ Public sector Undertakings/Private sector
……………………………. (Name of Company/ Society) incorporated /registered under the Companies Act,1956/2013/ the societies registration Act,1860 having its registered/corporate office at …………………… (hereinafter referred to as “Auditee” which expression shall unless repugnant to the context or meaning thereof, includes its successors, administrators and permitted assigns) of the first part .
And
Name incorporated/registered under the….….. Name of the Act having its registered/corporate office at ………………(herein referred to as “Auditor” which expression shall unless repugnant to the context or meaning thereof ,includes its seccessors,assigns,administrators,liquidators and recievers)of the second part WHEREAS
A.Auditor is a services organization empanelled by the Indian Computer Emergency Response Team (hereinafter CERT-IN) under Department of Electronics & IT, for auditing, including vulnerability assessment and penetration testing of computer systems , networks, computer resources & applications of various agencies or departments of the Government, critical infrastructure organizations and those in other sectors of Indian economy vide communication No…………dated…….
B.Auditor as an empanelled Information Security Auditing organization has agreed to fully comply the “Guidelines for CERT-In Empanelled Information Security Auditing Organizations , Terms & conditions of empanelment and Policy guidelines for handling audit related data” while conducting audits.
C.Auditee is also aware of the aforesaid Guidelines along with guidelines for Auditee Organizations published by CERT-In.
D.Both Auditor and Auditee have given their irrevocable consent to fully comply the aforesaid Guidelines and any amendments thereof without any reservations.
NOW, THEREFORE, in consideration of the foregoing and the covenants and agreements contained herein, the parties agree as follows:
1. Definitions. :
(a) The term “Confidential Information” shall include, without limitation, all information and materials, furnished by either Party to the other in connection with Auditee products and services including information transmitted in writing, orally, visually, (e.g. video terminal display) or on magnetic media, and including all proprietary information, customer & prospect lists, trade secrets, trade names or proposed trade names, methods and procedures of operation, business or marketing plans, licensed document know-how, ideas, concepts, designs, drawings, flow charts, diagrams, quality manuals, checklists, guidelines, processes, formulae, source code materials, specifications, programs, software packages, codes and other intellectual property relating to Auditee products and services. Results of any information security audits, tests, analysis, extracts or usages carried out by the Auditor in connection with the Auditee’s products and/or services, IT infrastructure, etc. shall also be considered Confidential Information.
 (b) The term “Auditee products” shall include all such products, goods, services, deliverables, which are subject to audit by the empanelled auditor under the Agreement.
 2 Protection of Confidential Information. With respect to any Confidential Information disclosed to it or to which it has access, Auditor affirms that it shall:
(a) Use the Confidential Information as necessary only in connection with scope of audit and in accordance with the terms and conditions contained herein;
(b) Maintain the Confidential Information in strict confidence and take all reasonable steps to enforce the confidentiality obligations imposed hereunder, but in no event take less care with the Confidential Information that the parties take to protect the confidentiality of its own proprietary and confidential information and that of its other clients;
(c) Not to make or retain copy of any details of products and/or services, prototypes, business or marketing plans, Client lists, Proposals developed by or originating from Auditee or any of the prospective clients of Auditee.
(d) Not to make or retain copy of any details of results of any information security audits, tests, analysis, extracts or usages carried out by the Auditor in connection with the Auditee’s products and/or services, IT infrastructure, etc. without the express written consent of Auditee.
(e) Not disclose or in any way assist or permit the disclosure of any Confidential Information to any other person or entity without the express written consent of theauditee ; and
(f) Return to theauditee, or destroy, at auditee’s discretion, any and all Confidential Information disclosed in a printed form or other permanent record, or in any other tangible form (including without limitation, all copies, notes, extracts, analyses, studies, summaries, records and reproductions thereof) immediately on (i) expiration or termination ofthis agreement, or (ii) the request of Auditee therefor.
(g) Not to send Auditee’s audit information or data and/or any such Confidential Information at any time outside India for the purpose of storage, processing, analysis or handling without the express written consent of the Auditee.
(h) The auditor shall use only the best possible secure methodology to avoid confidentiality breach, while handling audit related data for the purpose of storage, processing, transit or analysis including sharing of information with auditee.
(i) Not to engage or appoint any non-resident/foreigner to undertake any activity related to Information Security Audit. In case of information security audits for Government/ critical sector organization, only the man power declared to CERT-In shall be deployed to carry out such audit related activities.
(j) Not to discuss with any member of public, media, press, any or any other person about the nature of arrangement entered between the Auditor and the Auditee or the nature of services to be provided by Auditor to the Auditee.
(k) Make sure that all the employees and/or consultants engaged to undertake any audit on its behalf have signed the mandatory non-disclosure agreement.
3. Onus. Auditor shall have the burden of proving that any disclosure or use inconsistent with the terms and conditions hereof falls within any of the foregoing exceptions.
4. Permitted disclosure of audit related information:
The auditor may share audit information with CERT-In or similar Government entities mandated under the law as and when called upon to do so by such agencies with prior written information to the auditee.
5. Exceptions. The Confidentiality obligations as enumerated in Article 2of this Agreement shall not applyin following cases:
(a) Which is independently developed by Auditor or lawfully received from another source free of restriction and without breach of this Agreement; or
(b) After it has become generally available to the public without breach of this Agreement by Auditor; or
(c) Which at the time of disclosure to Auditor was known to such party free of restriction and evidenced by documents in the possession of such party; or
(d) Which Auditee agrees in writing is free of such restrictions.
(e) Which is received from a third party not subject to the obligation of confidentiality with respect to such Information;
6. Remedies. Auditor acknowledges that any actual or threatened disclosure or use of the Confidential Information by Auditor would be a breach of this agreement and may cause immediate and irreparable harm to Auditee or to its clients; Auditor affirms that damages from such disclosure or use by it may be impossible to measure accurately; and injury sustained by Auditee / its clients may be impossible to calculate and compensate fully. Therefore, Auditor acknowledges that in the event of such a breach, Auditee shall be entitled to specific performance by Auditor of its obligations contained in this Agreement. In addition Auditor shall compensate the Auditee for the loss or damages caused to the auditee actual and liquidated damages which may be demanded by Auditee. Liquidated damages not to exceed the Contract value. Moreover, Auditee shall be entitled to recover all costs of litigation including reasonable attorneys’ fees which it or they may incur in connection with defending its interests and enforcement of contractual rights arising due to a breach of this agreement by Auditor. All rights and remedies hereunder are cumulative and in addition to any other rights or remedies under any applicable law, at equity, or under this Agreement, subject only to any limitations stated herein.
7. Need to Know. Auditor shall restrict disclosure of such Confidential Information to its employees and/or consultants with a need to know (and advise such employees and/or consultants of the obligations assumed herein), shall use the Confidential Information only for the purposes set forth in the Agreement, and shall not disclose such Confidential Information to any affiliates, subsidiaries, associates and/or third party without prior written approval of the Auditee. No information relating to auditee shall be hosted or taken outside the country in any circumstances.
8. Intellectual Property Rights Protection. No license to a party, under any trademark, patent, copyright, design right, mask work protection right, or any other intellectual property right is either granted or implied by the conveying of Confidential Information to such party.
9. No Conflict. The parties represent and warrant that the performance of its obligations hereunder do not and shall not conflict with any other agreement or obligation of the respective parties to which they are a party or by which the respective parties are bound.
10. Authority. The parties represent and warrant that they have all necessary authority and power to enter into this Agreement and perform their obligations hereunder.
11. Governing Law. This Agreement shall be interpreted in accordance with and governed by the substantive and procedural laws of India and the parties hereby consent to the jurisdiction of Courts and/or Forums situated at < Name of the city>
12. Entire Agreement. This Agreement constitutes the entire understanding and agreement between the parties, and supersedes all previous or contemporaneous agreement or communications, both oral and written, representations and under standings among the parties with respect to the subject matter hereof.
13. Amendments. No amendment, modification and/or discharge of this Agreement shall be valid or binding on the parties unless made in writing and signed on behalf of each of the parties by their respective duly authorized officers or representatives.
14. Binding Agreement. This Agreement shall be binding upon and inure to the benefit of the parties hereto and their respective successors and permitted assigns.
15. Severability. It is the intent of the parties that in case any one or more of the provisions contained in this Agreement shall be held to be invalid or unenforceable in any respect, such provision shall be modified to the extent necessary to render it, as modified, valid and enforceable under applicable laws, and such invalidity or unenforceability shall not affect the other provisions of this Agreement.
16. Waiver. Waiver by either party of a breach of any provision of this Agreement, shall not be deemed to be waiver of any preceding or succeeding breach of the same or any other provision hereof.
17. Survival. Both parties agree that all of their obligations undertaken herein with respect to Confidential Information received pursuant to this Agreement shall survive till perpetuity even after expiration or termination of this Agreement.
18. Non-solicitation. During the term of this Agreement and thereafter for a further period of two (2) years Auditor shall not solicit or attempt to solicit Auditee’s employees and/or consultants, for the purpose of hiring/contract or to proceed to conduct business similar to Auditee with any employee and/or consultant of the Auditee who has knowledge of the Confidential Information, without the prior written consent of Auditee.
19. This Agreement is governed by and shall be construed in accordance with the laws of India. In the event of dispute arises between the parties in connection with the validity, interpretation, implementation or alleged breach of any provision of this Agreement, the parties shall attempt to resolve the dispute in good faith by senior level negotiations. In case, any such difference or dispute is not amicably resolved within forty five (45) days of such referral for negotiations, it shall be resolved through arbitration process, wherein both the parties will appoint one arbitrator each and the third one will be appointed by the two arbitrators in accordance with the Arbitration and Conciliation Act, 1996. The venue of arbitration in India shall be (please choose the venue of dispute resolution as the city) or where the services are provided. The proceedings of arbitration shall be conducted in English language and the arbitration award shall be substantiated in writing and binding on the parties. The arbitration proceedings shall be completed within a period of one hundred and eighty (180) days from the date of reference of the dispute to arbitration.
20. Term. This Agreement shall come into force on the date of its signing by both the parties and shall be valid up to ……… year.
IN WITNESS HEREOF, and intending to be legally bound, the parties have executed this Agreement to make it effective from the date and year first written above.
# In case of auditee being Central Government Ministry/ Departments #
For & on behalf of President of India
(Name and designation of authorized signatory)
……………………………
<Name of Central Govt. Ministry/Department>
Or
# In case of auditee being State Government Department #
For & on behalf of Governor of ……. < State name>
………………………..
(Name and designation of authorized signatory)
<Name of State Department>
Or
# In case of Autonomous Societies/Not-for-profit-company/Public sector undertaking /Private Sector #
for <Name of organization> , <Name and designation of authorized signatory> duly authorized by rules & regulations / of <Name of society>/ vide resolution no. …. Dated ……. Of Board of Directors of ...........<Name of organization>.
(AUDITEE) (AUDITOR)
WITNESSES:
1.
