Last updated: 8 September 2026
These Master Terms of Business apply to bespoke compliance and cybersecurity consultancy engagements agreed under a signed Proposal or Statement of Work ("SOW") with CyberSec Compliance Ltd. If you've purchased platform access directly through our website checkout without a separate Proposal or SOW, our Online Purchase Terms apply instead.
These terms cover our core activities: compliance assessment, framework mapping, policy/document generation, readiness and evidence support, ongoing compliance maintenance, and optional cybersecurity/GRC consultancy. They deliberately do not contain penetration-testing provisions.
These Terms of Business apply to services supplied by CyberSec Compliance Ltd to a customer acting in the course of business, they are not consumer terms.
The agreement is formed on the earliest of: the customer signing or electronically accepting a Proposal or Statement of Work; CyberSec Compliance accepting a purchase order referencing it; the customer completing an online order incorporating these terms; or CyberSec Compliance beginning services at the customer's request.
The agreement comprises, in descending order of precedence: any expressly agreed Special Conditions; the relevant Proposal/SOW or order; any Data Processing Addendum expressly incorporated; and these terms. Customer purchase-order terms don't apply unless expressly accepted in writing by CyberSec Compliance. Unless stated otherwise, a Proposal or quotation remains open for acceptance for 20 business days.
"Business Day" means a day other than Saturday, Sunday or a public holiday in England when banks in London are open for business. "Charges" means fees and other sums payable under the agreement. "Customer Data" means data, answers, records, evidence, files and other information supplied by or on behalf of the customer or entered into the platform.
"Deliverables" means reports, policies, procedures, registers, plans, statements of applicability, framework mappings, assessments, readiness packs, action plans, training materials, recommendations and other outputs identified in the Proposal/SOW or generated for the customer.
"Framework" means any standard, scheme, law, regulatory or assurance framework referenced by the services, including NCSC CAF, ISO/IEC 27001, Cyber Essentials, Cyber Essentials Plus and cyber-insurance evidence requirements.
"Platform" means CyberSec Compliance's hosted questionnaires, document-generation, evidence, compliance-management and associated portal functionality. "Professional Services" means cybersecurity and GRC consultancy, gap analysis, readiness review, risk and policy work, workshops, implementation support, training and advisory services described in a Proposal/SOW. "Services" means the Platform, Professional Services, Deliverables and support described in the applicable Proposal/SOW or order.
CyberSec Compliance will provide the services with reasonable care and skill and substantially in accordance with the applicable Proposal/SOW. Delivery dates are estimates unless expressly stated to be fixed, and time is not of the essence.
Either party may request a scope change; CyberSec Compliance isn't required to perform additional or changed work until the parties agree in writing the effect on charges, timing, dependencies and deliverables. Email approval by authorised representatives is sufficient unless the Proposal/SOW requires a formal change note.
If delivery is delayed by missing information, access, approvals, personnel, third-party dependencies or another matter for which the customer is responsible, CyberSec Compliance may reasonably extend the timetable and charge for additional time or costs caused by the delay. CyberSec Compliance may also make non-material changes needed for security, law, regulation, Framework updates or technical operation, provided the overall nature of the contracted services isn't materially reduced.
Professional Services are advisory and may include assessing current arrangements, identifying gaps, drafting or tailoring policies and procedures, risk and control design, implementation planning, workshops, evidence review, staff guidance, liaison with the customer's IT/MSP team, and support embedding agreed policies and processes.
Where implementation support is in scope, CyberSec Compliance may help the customer translate policy requirements into practical actions, governance routines, roles, records and control requirements. Unless a Proposal/SOW expressly says otherwise, CyberSec Compliance does not take operational ownership of the customer's IT environment or act as the customer's managed security, IT administration or engineering provider.
CyberSec Compliance will apply professional judgement to the information and evidence made available but does not independently verify every customer statement, configuration or control unless verification is expressly included in scope. The customer remains responsible for its governance, compliance decisions, technical environment, risk acceptance, operation of controls and implementation of recommendations, advice and deliverables do not transfer those responsibilities to CyberSec Compliance.
The platform assesses customer inputs against relevant Framework requirements and may generate tailored policies, procedures, registers, plans, mappings, readiness materials and other deliverables. The quality and relevance of outputs depend materially on the completeness and accuracy of customer data.
Use of the platform, a readiness score, generated documentation or implementation of recommendations does not guarantee certification, regulatory approval, tender success, insurance placement, insurance renewal, claim payment or any other third-party outcome.
Unless stated otherwise in the order, platform access is licensed, not sold. CyberSec Compliance may maintain, patch, secure, update or replace functionality, and may temporarily suspend access where reasonably necessary for maintenance, security or legal compliance. While customer data and deliverables are stored or processed within systems under CyberSec Compliance's control, CyberSec Compliance will apply the security and data-protection measures set out in this agreement, the customer should download and retain appropriate copies of material deliverables for its own records, subject to clause 7.4.
CyberSec Compliance is not a certification body, regulator, insurer or insurance broker, and does not issue ISO/IEC 27001, Cyber Essentials or Cyber Essentials Plus certification or regulatory CAF approval.
Framework requirements, guidance, auditor interpretations, insurer criteria and procurement requirements may change and may be applied differently by third parties, deliverables reflect the agreed scope, customer information and requirements reasonably available at the time.
Where CyberSec Compliance introduces or works alongside an MSP, certification body, auditor, insurer, broker or other third party, that third party remains responsible for its own services and decisions. CyberSec Compliance is not responsible for third-party performance unless expressly stated in the Proposal/SOW.
The customer must co-operate with CyberSec Compliance and provide timely access to appropriate personnel, systems, evidence, policies, records, accounts and other resources reasonably needed to perform the services. The customer warrants that information it supplies is, to the best of its knowledge, complete and accurate in all material respects, and that it has authority to provide customer data and materials for the agreed purposes.
The customer is responsible for deciding whether recommendations are appropriate, obtaining internal approvals, implementing and maintaining agreed policies, procedures and controls, and ensuring that its personnel, IT/MSP and other providers perform their responsibilities. This does not reduce CyberSec Compliance's responsibility for customer data while that data remains stored or processed within systems under its control.
Where the customer downloads, exports or otherwise transfers a deliverable or customer data from the platform to a system, device, storage location or service controlled by the customer or a third party acting on its behalf, the customer becomes responsible for the security, storage, access, use, disclosure, retention, backup and processing of that downloaded or transferred copy. CyberSec Compliance remains responsible under this agreement for customer data that continues to be stored or processed within systems under its control.
The customer must keep account credentials confidential, promptly remove access no longer required, notify CyberSec Compliance without undue delay of suspected unauthorised account access, and must not misuse the platform, interfere with its operation, introduce malicious code, attempt unauthorised access, reverse engineer protected elements, or use the services for unlawful purposes.
Where the Proposal/SOW includes acceptance criteria, those criteria apply. Otherwise, a deliverable is treated as accepted if the customer does not notify CyberSec Compliance of a material non-conformity within 10 business days after delivery. CyberSec Compliance will use reasonable efforts to correct a properly notified material non-conformity caused by its failure to provide the services with reasonable care and skill.
Deliverables are prepared for the customer and the purposes stated in the Proposal/SOW. No third party may rely on a deliverable without CyberSec Compliance's prior written consent, CyberSec Compliance may agree specific reliance wording or a reliance letter for an additional fee.
The customer will pay the charges set out in the Proposal/SOW or order. Unless stated otherwise, charges are exclusive of VAT and reasonable pre-approved travel and subsistence expenses.
For Professional Services, CyberSec Compliance may invoice monthly in arrears, against agreed milestones, on delivery, or as stated in the Proposal/SOW, invoices are payable within 30 days unless a different period is stated. Platform and product charges may be payable in advance and may include recurring subscriptions; the applicable order or checkout summary will state the billing period, initial access period and renewal basis.
If a sum is overdue, CyberSec Compliance may charge interest at 4% per annum above the Bank of England base rate, accruing daily, and may suspend affected services after reasonable notice. Undisputed amounts must be paid without set-off or counterclaim. A customer disputing an invoice in good faith must notify CyberSec Compliance promptly with reasonable details and pay the undisputed portion by the due date.
Where services are supplied on a recurring subscription, the subscription continues for the period and renewal cycle stated in the order until cancelled in accordance with that order. Cancellation prevents future renewals but does not ordinarily refund charges already due for the current billing period. If an order includes an initial fixed platform access period, access may be suspended when it ends unless the customer has purchased or continued the relevant subscription.
Pre-purchased consultancy days, credits or call-off services expire as stated in the Proposal/SOW. If no expiry is stated, unused pre-purchased time expires 12 months after the effective date unless otherwise agreed in writing. CyberSec Compliance may suspend access or services for non-payment, material misuse, security risk or material breach while the issue is investigated or remedied.
Each party retains intellectual property rights it owned or developed independently of the agreement. CyberSec Compliance's Background IP includes the platform, source code, policy/template libraries, methodologies, mappings, questionnaires, workflows, generic tools and know-how.
Subject to payment of applicable charges, the customer owns the organisation-specific content of deliverables created specifically from its customer data, excluding CyberSec Compliance Background IP embedded in or necessary to create them. CyberSec Compliance grants the customer a perpetual, worldwide, non-exclusive, royalty-free licence to use, copy, adapt and internally distribute embedded Background IP solely as part of the deliverable for the customer's own business, compliance, assurance, audit, procurement and insurance purposes.
The customer must not extract, commercialise, resell, publish as a template library, sublicense as a standalone product, or use CyberSec Compliance Background IP to create a competing product or service. The customer grants CyberSec Compliance a non-exclusive licence to use customer materials and customer data only as reasonably necessary to provide, secure and support the contracted services, subject to confidentiality and data-protection obligations.
Each party must keep the other's confidential information confidential, use it only for the agreement, and disclose it only to personnel, advisers and subcontractors who need to know it and are bound by appropriate confidentiality obligations. Confidential information excludes information that is lawfully public, already lawfully known without restriction, independently developed without use of the other party's confidential information, or lawfully received from a third party without a duty of confidence.
A party may disclose confidential information where required by law, court order or a competent regulator, giving advance notice where legally permitted. CyberSec Compliance may use genuinely anonymised and aggregated information that does not identify the customer, its personnel, systems or confidential business information for service analytics and improvement, and will not identify the customer publicly as a case study without consent.
Each party will comply with applicable UK data-protection law, including UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003. Each party acts as an independent controller for personal data processed for its own administration, billing, relationship management, security and legal compliance. Where CyberSec Compliance processes personal data solely on the customer's documented instructions as processor, Schedule 1 applies.
The customer is responsible for ensuring it has a lawful basis and has provided any required privacy information for personal data supplied to CyberSec Compliance. CyberSec Compliance will maintain appropriate technical and organisational measures proportionate to the risks of processing, and will notify the customer without undue delay after becoming aware of a personal data breach affecting personal data for which CyberSec Compliance acts as processor. International transfers, subprocessors and retention will be handled in accordance with applicable law and Schedule 1.
CyberSec Compliance will maintain appropriate technical and organisational measures designed to protect the confidentiality, integrity and availability of customer data under its control, including questionnaire responses and other information supplied through the platform, taking account of the nature of the services and the risks involved.
CyberSec Compliance's responsibility for protecting customer data continues for so long as that data is retained or processed within systems under CyberSec Compliance's control, downloading a deliverable does not end CyberSec Compliance's obligations in relation to the copy of the underlying customer data, or any deliverable, that remains within CyberSec Compliance's systems.
Once a deliverable or other data is downloaded, exported or otherwise transferred from the platform to a system, device, storage location or service controlled by the customer or a third party acting on its behalf, the customer is responsible for the security, storage, access controls, use, disclosure, retention, backup and processing of that downloaded or transferred copy. CyberSec Compliance is not responsible for loss, unauthorised access, disclosure, corruption, alteration or deletion of a downloaded or transferred copy to the extent arising after that copy has left systems under CyberSec Compliance's control, except to the extent caused by CyberSec Compliance's breach of this agreement.
CyberSec Compliance warrants that Professional Services will be performed with reasonable care and skill. Except as expressly stated in the agreement, all other warranties, conditions and terms implied by statute, common law or otherwise are excluded to the fullest extent permitted by law.
CyberSec Compliance does not warrant that the services are error-free, uninterrupted, suitable for every regulatory interpretation, or sufficient by themselves to achieve certification, audit, procurement, insurance or compliance outcomes. CyberSec Compliance is not responsible for loss caused by the customer's failure to follow agreed implementation steps, maintain policies or controls, obtain approvals, keep information current, or appropriately secure, store, back up or control access to copies of deliverables after they've been downloaded or transferred to systems outside CyberSec Compliance's control.
Nothing in the agreement limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.
Subject to that, CyberSec Compliance is not liable for indirect or consequential loss, or for loss of profit, revenue, business, anticipated savings, goodwill, opportunity or third-party certification/insurance/procurement outcome, nor to the extent loss is caused or increased by inaccurate or incomplete customer information, failure to implement or maintain recommendations or controls, unauthorised or unapproved changes, third-party systems/services, use outside the agreed scope, or the customer's failure to appropriately secure, store, back up or control access to downloaded or transferred copies after they've left systems under CyberSec Compliance's control. This exclusion does not limit CyberSec Compliance's responsibility for customer data that remains within systems under its control.
CyberSec Compliance's total aggregate liability arising out of or in connection with a particular Proposal/SOW is limited to the total charges paid or payable under that Proposal/SOW in the 12 months preceding the event giving rise to the claim or, for a one-off engagement shorter than 12 months, the total charges paid or payable for that engagement. The customer acknowledges that cybersecurity and compliance outcomes depend on systems, people and third parties outside CyberSec Compliance's control, and that the charges reflect the allocation of risk in this clause.
The customer will indemnify CyberSec Compliance against third-party claims, losses and reasonable costs arising from customer materials infringing third-party intellectual property rights, or from the customer's unlawful or unauthorised use of the services, except to the extent caused by CyberSec Compliance's breach or negligence. An indemnified party must give prompt notice of a claim, allow reasonable control of the defence and settlement, and provide reasonable co-operation at the indemnifying party's cost.
Either party may terminate the affected agreement immediately by written notice if the other commits a material breach that is incapable of remedy or, if remediable, is not remedied within 30 days after written notice. Either party may also terminate immediately if the other enters insolvency, administration, liquidation or an analogous process, except for a solvent restructuring.
On termination, the customer must pay charges properly due for services supplied and committed non-cancellable costs. CyberSec Compliance will make customer deliverables available for the period stated in the order/SOW and will then delete or return customer data in accordance with Schedule 1 and applicable retention obligations. Clauses intended by their nature to survive termination, including confidentiality, intellectual property rights, accrued payment rights, liability, data protection and governing law, will survive.
Neither party is liable for delay or failure caused by an event beyond its reasonable control, excluding payment obligations. The affected party must notify the other as soon as reasonably practicable and use reasonable efforts to mitigate the effect. If such an event materially prevents affected services for more than 45 consecutive days, either party may terminate those affected services on written notice, with charges adjusted for services properly supplied up to termination.
CyberSec Compliance may use suitably qualified employees, contractors and subprocessors to provide the services and remains responsible for its contractual obligations. Third-party products or services identified as separate third-party services may be subject to their own terms, CyberSec Compliance is not responsible for a third party's independent service, certification decision, audit, insurer decision or technical implementation unless expressly stated in the Proposal/SOW.
No variation is effective unless agreed in writing by authorised representatives, except for non-material platform changes and online-policy updates expressly permitted by the agreement. Neither party's delay in exercising a right is a waiver. If a provision is invalid or unenforceable, it will be modified or deleted to the minimum extent necessary and the remainder continues in force.
The agreement is the entire agreement concerning its subject matter and supersedes prior discussions and representations, but does not exclude liability for fraud or fraudulent misrepresentation. Neither party may assign the agreement without the other's prior written consent, not to be unreasonably withheld or delayed, except that CyberSec Compliance may assign it as part of a bona fide sale, reorganisation or transfer of substantially all relevant business/assets.
Nothing creates a partnership, joint venture, fiduciary relationship or agency. A person who is not a party has no right to enforce the agreement under the Contracts (Rights of Third Parties) Act 1999. Notices concerning termination, breach or legal claims must be in writing and sent to the registered office or a notified legal email address.
The agreement and any non-contractual obligations arising from it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction. Before commencing proceedings, the parties will use reasonable efforts to resolve a dispute through good-faith escalation between senior representatives, except where urgent protective relief is required.
1. Roles and instructions. Where CyberSec Compliance processes personal data on behalf of the customer, the customer is the controller and CyberSec Compliance is the processor unless otherwise agreed in writing. CyberSec Compliance will process that personal data only on documented instructions from the customer, including the agreement, unless required by law.
2. Processing details. The subject matter and duration are the provision of the contracted services for the term of the agreement and any agreed deletion/return period. Processing may include hosting, storing, organising, retrieving, generating documents from, supporting and securing customer data. Data subjects may include the customer's staff, contractors, suppliers, clients and other individuals whose information the customer provides. Personal data may include identity/contact details, role information, business records, security and compliance evidence and other categories expressly supplied. The customer must not provide special-category or criminal-offence data unless necessary and expressly agreed.
3. Processor obligations. CyberSec Compliance will ensure authorised persons are subject to confidentiality obligations; implement appropriate technical and organisational measures; assist the customer, taking account of the nature of processing, with data-subject requests and relevant security, breach, DPIA and regulatory consultation duties where reasonably possible; and make information reasonably necessary to demonstrate compliance available to the customer. CyberSec Compliance will notify the customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the customer's behalf.
4. Subprocessors and transfers. The customer gives general written authorisation for CyberSec Compliance to appoint subprocessors needed to provide the services. CyberSec Compliance will impose appropriate data-protection obligations on subprocessors and remains responsible for their processing to the extent required by UK GDPR. CyberSec Compliance will maintain or publish a current list of material subprocessors (see our Sub-Processors page) and provide a reasonable mechanism for the customer to raise legitimate data-protection objections to a new subprocessor. Restricted transfers of personal data outside the UK will only take place using a lawful transfer mechanism and appropriate safeguards where required.
5. Return, deletion and audit. At the end of relevant services, CyberSec Compliance will, at the customer's choice and subject to the service's standard retention process, return or delete personal data processed on the customer's behalf unless law requires retention. Backup copies may persist for a limited period until overwritten in the ordinary cycle and will remain protected. On reasonable written request, CyberSec Compliance will provide information reasonably necessary to demonstrate compliance; any on-site audit must be proportionate, during business hours, protect other customers' confidentiality, and be at the customer's cost unless it identifies a material breach by CyberSec Compliance.
Every Proposal or Statement of Work we issue is specific about whether CyberSec Compliance is advising, helping the customer implement policies/processes, reviewing evidence, or working alongside the customer's IT/MSP on implementation actions. Each Proposal/SOW sets out: the customer's legal entity and contacts; the framework(s) and business objective; the platform/package included; the consultancy scope and deliverables; whether implementation support is advisory or includes policy/process implementation; explicit exclusions and third-party responsibilities; customer dependencies, approvals, backups and access; acceptance criteria; project dates and assumptions; charges, expenses and invoicing; data-processing particulars and any special-category data; any special liability or insurance requirements; any third-party reliance rights; and any Special Conditions or order of precedence.