The Supplier is in the business of providing Cyber Security and Information Technology Services.
The Customer wishes to obtain, and the Supplier wishes to provide, the Services on the terms set out in this agreement.
Agreement Commencement Date: the date when the agreement has been signed by all the parties.
APP: means an Australian Privacy Principle as defined in the Privacy Act.
APP Entity: has the meaning given in the Privacy Act.
AWS Order: is an order placed through the AWS Marketplace portal.
Business Day: a day on which banks are open for business in Sydney, other than a Saturday, Sunday or public holiday.
Business Hours: the period from 9.00 am to 5.00 pm on any Business Day.
Change Order: has the meaning given in clause 7.1.
Consumer Price Index: the Consumer Price Index (All Groups) (Australia) published by the Australian Bureau of Statistics.
Control: the definition given to that term in section 50AA of the Corporations Act and the expression change of control shall be construed accordingly.
Corporations Act: the Corporations Act 2001 (Cth).
Customer’s Equipment: any equipment, including tools, systems, cabling or facilities, provided by the Customer, its agents, subcontractors or consultants which is used directly or indirectly in the supply of the Services.
Customer Materials: all documents, information, items and materials in any form, whether owned by the Customer or a third party, which are provided by the Customer to the Supplier in connection with the Services.
Customer’s Representative: has the meaning given in 5.1(b).
Data Breach Investigation: an investigation as required to be carried out in accordance with 11.3(c).
Data Incident: an Eligible Data Breach that has, or is reasonably suspected of having, occurred in respect of any Personal Information the Supplier has collected, held, used or disclosed in the course of or relating to this agreement.
Deliverables: any output of the Services to be provided by the Supplier to the Customer as specified in an Order and any other documents, products and materials provided by the Supplier to the Customer in relation to the Services (excluding Hardware and Software and the Supplier’s Equipment).
Eligible Data Breach: an eligible data breach as that term is defined in the Privacy Amendment (Notifiable Data Breaches) Act 2016 (Cth), occurring on or after 22 February 2018.
GST: goods and services tax chargeable under A New Tax System (Goods and Services Tax) Act 1999 (Cth).
GST Law: has the same meaning as “GST Law” in the A New Tax System (Goods and Services Tax) Act 1999 (Cth).
Hardware: any physical product sold to the Customer by the Supplier.
Intellectual Property Rights: patents, rights to inventions, copyright and related rights, trademarks, business names and domain names, technology and all other intellectual property rights, whether registered or unregistered.
Log Files: computer or software generated machine data / telemetry, ingested into Sekuro’s Managed Service platforms, containing information about the operations, activities and usage patterns within the Customer’s ITC / OT environment.
Managed Services: where the Supplier provides certain, ongoing cyber security services as specified in the Managed Services Schedules to this Agreement
Milestone: a date by which a part or all of the Services is to be completed, as set out in an Order
Order: means either:
Personal Information: has the meaning given in the Privacy Act.
Privacy Act: the Privacy Act 1988 (Cth) as amended from time to time.
Professional Services: the provision of information technology professionals for consulting, design, development, implementation or training projects as described in an Order
Proposal: a document describing the Services to be provided by the Supplier and applicable pricing and charges.
Quote: a quotation for Services to be provided, including applicable Service Charges.
Resale Services: services (including support) that are performed by a third-party vendor and resold to the Customer by the Supplier under the Agreement.
Sensitive Information: has the meaning given in the Privacy Act.
Service Charges: the amounts payable for the Services as set out in the relevant Order
Services: the services to be provided to the Customer as set out in an Order, which may include the provision of Hardware, Software, Professional Services, Managed Security Services or any other services offered by the Supplier and agreed to be supplied under an Order.
Software: software (including any software-as-a-service or licenced software) that is owned by a third-party vendor and provided to the Customer by the Supplier under the Agreement.
Statement(s) Of Work (SoW(s)): a document describing the Services to be provided by the Supplier and applicable pricing and charges.
Supplier’s Equipment: any equipment (other than Hardware), including tools, systems, cabling or facilities, provided by the Supplier to the Customer and used directly or indirectly in the supply of the Services.
Term: has a meaning given in clause 2.1.
From the date of an Order until 12 months after its completion, neither party will, without the prior written consent of the other party, employ or engage or attempt to employ or engage any employee or contractor of the other party involved in the provision of the Services.
Neither party may assign any right arising out of this agreement, or novate the agreement, without the other party’s prior written consent, which must not be unreasonably withheld. The Supplier may subcontract any of its obligations under this agreement and remains responsible for the performance of the Services under this agreement.
An amendment or variation of any term of this agreement must be in writing and signed by each party.
No party may rely on the words or conduct of any other party as being a waiver of any right, power or remedy arising under or in connection with this agreement unless the other party or parties expressly grant a waiver of the right, power or remedy. Any waiver must be in writing, signed by the party granting the waiver and is only effective to the extent set out in that waiver.
This agreement states all the express terms agreed by the parties about its subject matter. It supersedes all prior agreements, understandings, negotiations, proposals and discussions in respect of its subject matter.
Nothing in this agreement gives a party authority to bind any other party in any way or imposes any fiduciary duties on a party in relation to any other party.
This agreement may be executed in any number of counterparts.
The following additional terms and conditions contained in this Schedule 1 apply to the provision of Services only where the Customer is acquiring Offensive Security, Penetration Testing, Red Teaming Services or Incident Response Services (as defined below or referred to in any relevant Order).
Where Supplier is providing services designed to test the security of the Customer’s environment (including Penetration Testing), the Customer acknowledges that the nature of the Services is such that the Supplier will actively attempt to breach security controls in order to obtain access to the Customer systems and data and that such attempts might otherwise amount to criminal activity. Customer specifically consents to the Supplier attempting to gain such access to systems and data (except for any systems or data specifically referred to as out of scope) and that if Supplier activities are identified by Customer staff and reported to any external body (including law enforcement agencies), the Customer will promptly confirm to that external body that the Supplier is acting in an authorised manner.
The Customer acknowledges that security testing is inherently risky due to the potential frailties of networks and their reaction to unknown variables and that intrusion testing will largely take place over open public networks, and that a risk exists of information being accidentally disclosed to third parties.
The Customer acknowledges that Services and Deliverables designed by the Supplier to test the security of the Customer’s environment have the potential to cause damage. The Customer shall defend and hold the Supplier harmless from any claim, suit, damages and expenses (including, but not limited to legal costs) arising out of
the misuse of the Services or Deliverables (other than by the Supplier);
deploying the Services or Deliverables in accordance with the Customer’s instructions
Customer’s failure to comply with applicable laws, rules, and/or regulations regarding use of the Services and Deliverables; or
The following additional terms and conditions contained in this Schedule 2 apply to the provision of Services only where the Customer is purchasing Resale Services and Software under an Order.
Vendor Terms
Where the Supplier is reselling a service, either Resale Services or Software, those Services will be subject to any vendor terms provided to the Customer prior to or at the time of accepting the Services (Vendor Terms). Vendor Terms may take the form of an end-user licence agreement and may be provided separately or be included as click-through terms of use of the Service. The Customer agrees that as a condition of accepting Resale Services or Software, it will agree to the Vendor Terms and failure to do so could result in the Customer being unable to use the Resale Services or Software, in which case the Customer will still be liable for the Service Charges set out in the relevant Order.
The Customer agrees that, to the extent permitted by law and without limiting the Customer’s rights against the Supplier, if it has a claim in respect of the Resale Services or Software under the applicable Vendor Terms or otherwise as available at law (including the Competition and Consumer Act 2010 (Cth) if applicable) it will, along with any redress it chooses to seek, pursue that claim against the relevant vendor.
A failure of the Customer to comply with its obligations under the Vendor Terms is grounds for the Supplier to suspend, or if irreparable, terminate the provision of the relevant Resale Services or Software. In this event, the Customer will remain liable for the Service Charges set out in the relevant Order.
The Customer acknowledges that the Supplier has no direct control over the features or performance of the Resale Services and Software and is bound to only supply those Services on strict resale terms which include passing through the Vendor Terms. As a result, the Customer agrees that in no circumstances (other than as prescribed by law) will the Supplier be liable for any amount or provide any warranties in relation to the Resale Services or Software that exceed the liability accepted and warranties provided by the relevant vendor in the Vendor Terms.
Software Pricing
The Supplier agrees to maintain the Software licence charges set out in the relevant Order for the initial licence period. After the initial licence period, where the Customer continues to use the Software, the Supplier may, on reasonable notice to the Customer, increase the licence charges, which may include passing on incremental increases proportionate to increased pricing from relevant vendors and any other input costs including operational costs and currency fluctuations.
In the event that a vendor conducts an audit of your use of Software and reasonably establishes that your use of the Software exceeded the licence volume during any period, you will be liable to promptly pay for that use. The Customer acknowledges that this is a right that the vendor may enforce against the Supplier as a reseller and agrees that it is reasonable to pass this onto the Customer as the beneficiary of the use of the Software. Despite anything to the contrary, this clause survives termination of the Agreement.
Intellectual Property
The following additional terms and conditions contained in this Schedule 3 apply to the provision of Services only where the Customer is purchasing Hardware under an Order.
Delivery
Deliveries shall be made during normal working hours and at the cost and risk of the Customer.
The act of receiving the Hardware at the specified delivery address will constitute acceptance of the Hardware by the Customer. In the event the Customer or the Customer’s agent was not available to accept the delivery, then the driver’s signature, denoting the time, date & place of delivery shall be deemed to be acceptance of the said delivery by the Customer.
The Customer acknowledges that Hardware delivered to a courier is outside the Supplier’s control, and the Supplier will not be liable for any loss, damage, delay or non-delivery of Hardware contributed to by a third party, to the extent permitted by law.
Ownership and Possession
Notwithstanding the delivery of any Hardware, the Hardware remains the sole and absolute property of the Supplier as full legal and equitable owner until such time as the Customer has paid the Supplier the full purchase price of the Hardware. Risk in all Hardware purchases passes to the Customer on delivery.
The Customer acknowledges that it receives possession of and holds Hardware delivered by the Supplier solely as bailee for the Supplier until such time as the full price for the Hardware has been paid to the Supplier. Until such time as the Customer becomes the owner of the Hardware, it must:
Store them on the premises separately;
Ensure that the Hardware are kept in good and serviceable condition;
Secure the Hardware from risk, damage and theft; and
Keep the Hardware fully insured against such risks that are usual or common to insure against in a business of a similar nature to that of the Customer.
Should the Customer stop payment or call a meeting of its creditors or become insolvent or subject to the bankruptcy law or being a company calls a meeting for the purpose of or to go into liquidation or have a winding-up petition presented against it or has a receiver or administrator appointed, the Supplier may at its option notwithstanding its waiver of such default or failure and without prejudice to its other rights under this agreement suspend or cancel this agreement or require payment in cash before or on delivery or tender of Hardware or documents notwithstanding terms of payment previously specified or may, subject to the law, repossess and take over the Hardware and dispose of the same in its own interest without prejudice to any claim it may have for damages for any loss resulting from such resale.
If the Customer does not pay for any Hardware on the due date then the Supplier is hereby irrevocably authorised by the Customer to enter the Customer’s premises (or any premises under the control of the Customer or as agent of the Customer in which the Hardware are stored at such premises) and use reasonable force to take possession of such Hardware without liability for the tort of trespass, negligence or payment of any compensation to the Customer whatsoever.
On retaking possession of the Hardware the Supplier may elect to refund to the Customer any part payment that may have been made and to credit the Customer’s account with the value of the Hardware less any charge for recover of the Hardware, or to resell the Hardware.
Security and PPSA
For the purposes of this clause, “PPSA” means the Personal Property Securities Act 2009 (Cth) as amended from time to time. Where a particular section or term from the PPSA is used in this agreement, it is deemed to be that section or term as defined or used in the PPSA as amended, renumbered or replaced from time to time.
The Customer acknowledges and agrees that this agreement constitutes a security agreement in relation to the Supplier’s security interest in all present and after-acquired Hardware for the purposes of the PPSA. The Customer agrees to grant a “Purchase Money Security Interest” to the Supplier.
For the avoidance of doubt, the Customer acknowledges and agrees that it grants to the Supplier a security interest in all Hardware supplied by the Supplier to the Customer (whether now or in the future) and in any proceeds from the sale of those Hardware.
To the extent permitted by law, the following provisions of the PPSA do not apply and for the purposes of section 115 of the PPSA are contracted out of this agreement:
sections 95 (notice of removal of accession), to the extent that it requires the Supplier to give notice to the Customer, 96 (retain of accession) and 125 (obligation to dispose of or retain collateral);
section 130 (notice of disposal), to the extent that it requires the Supplier to give notice to the Customer;
section 132(3)(d) (contents of statement of account after disposal);
section 132(4) (statement of account if no disposal);
section 135 (notice of retention);
section 142 (redemption of collateral); and
section 143 (reinstatement of security agreement).
For the purposes of section 14(6) of the PPSA, the Customer (and the Supplier) agree that any payments received from the Customer by the Supplier pursuant to or in any way connected with this agreement will be applied in such order as the Supplier deems fit in its absolute discretion.
The Customer consents to:
execute any other document or instrument required to give effect to the security interests created by this agreement; and
the registration with the relevant authority or public register of any security interest created by this agreement or any other document required to give effect to a security interest created by this agreement, including without limitation the registration of a financing statement or financing change statement on the Personal Property Securities Register.
The Customer must pay all costs of and incidental to the preparation, execution and registration of any instrument which is executed for the purposes of giving effect to this clause and must also pay all costs incidental to the withdrawal, discharge or release of such instrument.
To the extent permissible at law, the Customer waives its right to receive notification of or a copy of any Verification Statement confirming registration of a Financing Statement or a Financing Change Statement relation to a Security Interest granted by the Customer as Grantor to the Supplier.
Returns
Returns on Hardware can only be accepted if authorised in writing by the Supplier (which may be given, given with conditions, or withheld at the absolute discretion of the Supplier), and the Hardware are in the same condition as delivered and within 14 days of delivery. The Supplier reserves the right to charge the Customer for any costs or losses incurred by the Supplier, in addition to any amounts charged by the third-party manufacturer or distributor of the Hardware.
Hardware Pricing
The price of any Hardware is quoted EXW (Incoterms 2010) from the Supplier’s premises.
Installation of Hardware
The Supplier will only be responsible for the installation of the Hardware where specified in an Order. Acceptance of the Hardware will not be contingent on installation unless explicitly set out in the terms of the Order and liability for payment for the Hardware will arise on delivery.
Pricing and details of installation will be set out in the Order.
Where Supplier personnel are required to attend the Customer’s premise to conduct the installation, the Customer will ensure a safe working environment and indemnify the Supplier and its personnel for any injury or loss arising on the Customer’s premises.
Manufacturer’s terms
Provision of the Hardware and ongoing maintenance and support (if included) may be provided on the basis of the Customer accepting end-user terms directly with the Hardware manufacturer (Manufacturer). The Customer agrees that as a condition of accepting the Hardware, it will enter into end user terms if provided and failure to do so could result in a failure to complete the sale and a return of goods in accordance with the above.
The Customer acknowledges that the Supplier has no direct control over the features or performance of the Hardware and is bound to only supply the Software on strict resale terms which include passing through Manufacturer terms. As a result the Customer agrees that, to the extent permitted by law and without limiting the Customer’s rights against the Supplier, if it has a claim in respect of the Hardware under any end user agreement or otherwise as available at law (including the Competition and Consumer Act 2010 (Cth) if applicable) it will, along with any redress it chooses to seek, pursue that claim against the Manufacturer.
The following additional terms and conditions contained in this Schedule 4 apply to the provision of Services only where the Customer is acquiring Team Augmentation under an Order. For the purpose of this Schedule, we, us, our is a reference to the Supplier and you, your is a reference to the Customer.
Relationships
Whilst on an assignment, our consultant/s (Consultants) will be under your day-to-day control, and you will be responsible for their supervision.
We reserve all other rights to control the employment or other contract relationship with our Consultants.
If you are not satisfied with one of our Consultants and want a replacement, you will:
speak to us directly about the replacement of our Consultant; and
Our Charges
Consultant’s work attendance records will be emailed to you, as set out in the Order, every week through our work attendance software. You agree to ensure the approver/s promptly respond to the previous week’s work attendance records.
Invoicing and Charges
We may withdraw the services of the Consultant immediately if payment is not made within the payment terms specified in the Order. Any additional costs incurred by us and/or our agents in securing payment will be charged and invoiced to you, and you agree to pay any such invoice received from us in accordance.
In addition to sums due to us in respect of invoices rendered for work carried out by the Consultant, you will pay to us all reasonable expenses incurred by the Consultant in carrying out the work for you, provided that any such expenses have been authorised by you through our work attendance software, or in writing.
General matters and other responsibilities
You will:
provide us with full and accurate information about the job requirements relevant to the assignment by means of an assignment description;
provide the Consultant with a suitable place for the Consultant to carry out his or her work that is comparable to and of a similar standard to that provided by you for your permanent staff;
not allocate tasks or responsibilities to our Consultants or require our Consultants to perform or participate in work, other than in accordance with the relevant assignment description;
not request our Consultants to perform or participate in any work or use any equipment with which our Consultants, or their employees or agents, are unfamiliar or in respect of which they are unqualified or have not received adequate training;
comply with your obligations to our Consultants pursuant to relevant legislation, including legislation relating to workplace or occupational health and safety, discrimination and harassment.
maintain a safe work environment and safe systems of work; establish safe work practices; communicate safe work procedures to each of our Consultants; comply with safety standards; maintain plant and equipment; and provide site-specific induction, training and safety consumables to our Consultants where appropriate;
inform our Consultants and us promptly of any unusual workplace risk or practice or of any change in the site or safety conditions that may present a hazard to our Consultants.
comply with our reasonable requests to ensure the workplace health and safety of our Consultants and to promptly rectify any deficiency in the provision of a safe work environment or safe systems of work that, in our reasonable opinion, would pose a threat to the safety of one of our Consultants or to any other person who may attend a place at which work is or may be performed by one of our Consultants under the assignment;
notify us immediately of any event that may give rise to a claim under any insurance policy, statutory indemnity or self-insurance arrangement that relates to our Consultants, whether such policy, indemnity or arrangement is held or established by you or by us;
report to us any performance issues in relation to our Consultants in a written format so that we can manage the feedback process with our Consultants;
forward to us promptly a written notification of any workplace incident that may give rise to a claim by, against or involving our Consultants; and
Our responsibilities
We are responsible for the following in relation to our Consultants whilst on assignment with you:
establish and maintain communication methods for our Consultants to contact us if they consider that there is a risk to their health or safety;
the payment of all amounts due to our Consultants under the terms of any relevant industrial instruments or contracts;
if our Consultant is an employee, the payment of leave entitlements (if any), including but not limited to annual leave, sick leave, parental leave and long service leave;
subject to the Assignment Details, the deduction and/or remittance of all appropriate Federal and State taxes, including but not limited to income tax, fringe benefits tax and payroll tax, as may be required by law;
workers’ compensation under applicable legislation in the relevant jurisdiction, unless the legislation casts that responsibility on you;
the payment of an amount as superannuation into a superannuation fund to avoid the imposition of any charge as may be required by law; and
Exclusions and Indemnity
Where they are acting under your direction we make no representation or guarantee that any of our Consultants will achieve a certain level of performance, achieve a certain outcome, solve a particular problem or attain a specific goal.
Our Consultants may refuse work if it reasonably appears that the working environment is or has become unsafe for any reason, including but not limited to you:
having not established safe work procedures;
not complying with safety standards;
not maintaining plant and equipment; or
not complying with any relevant health or safety legislation or regulations;
Intellectual Property
We assign the rights to any intellectual property developed by the Consultant in the course of carrying out the Assignment to you.
The following additional terms and conditions contained in this Schedule 5 apply to the provision of Services only where the Customer is purchasing the Sekuro Cyber Resiliency Program (CRP or the Program) under an Order.
CRP Services
The Cyber Resilience Program is a program of Services designed to deliver a strategic and programmatic approach to cyber security. It goes beyond individual services and solutions, providing an ongoing security program, tailored to continuously improve cyber security posture and maturity.
Term and Price of Service
The Program will be priced in accordance with the relevant Order and may consist of a once-off onboarding charge and an ongoing, periodic service charge.
The Program will continue from the service commencement date until cancelled in accordance with clause 6 below.
On each anniversary of the Program, the monthly service charges will increase in line with the Consumer Price Index, unless alternative pricing has been agreed by way of an Order.
At the end of any term specified in an Order, the Program, and the associated ongoing, periodic service charges will continue, unless varied in accordance with clause 7.
Variation and Cancellation
Subject to any term specified in an Order, either party may cancel the Program by giving the other party written notice of its intention to cancel the service on 3 complete months’ notice. The service will terminate 3 months after the end of the month in which the notice is given.
If either party wishes to vary the Program in terms of scope, pricing or applicable rates (other than in accordance with clause 6) they will provide the other party details of the requested change. If the changes are agreed in writing, they will take effect 3 months after the end of the month in which they are agreed (unless the parties mutually agree that they apply sooner).
Customer Obligations
The Customer will:
promptly notify the Supplier about any changes proposed or made to the Customer IT environment and architecture which may affect any aspect of the CRP Services;
make all reasonably requested changes required by the Supplier to the Customers IT environment to enable the proper performance of the CRP Services; and
Incorporation of other Services
CRP may incorporate other Services, including, but not limited to, Offensive Security Services. The Schedules to this agreement that relate to those Services apply to those elements of the CRP.
The following additional terms and conditions contained in this Schedule 6 apply to the provision of Services only where the Customer is acquiring Incident Response Services under an Order, as described therein.
For the purpose of this Schedule, we, us, our is a reference to the Supplier and you, your is a reference to the Customer.
Fees and charges
You must pay us the fees in the amounts and at the times set out in the Order.
You acknowledge that units of time shall be charged for time spent on or incidental to the Services at the rates set out in the Order. Units of time will be billed in 6-minute increments.
Where pricing is based on use, we round up use in the billing period to the nearest whole unit (for example, 1.4GB is rounded up to 2GB).
You must reimburse us for out-of-pocket expenses reasonably and actually incurred by us in performing the Services, including but not limited to data storage devices, consumables, travel costs and couriers.
We may charge you, and you agree to pay, our reasonable costs incurred in identifying, examining and rectifying any of the following faults:
faults resulting from interference caused by you or any person accessing the products you are receiving using your password or access key or by your invitation;
faults caused by your breach of these Terms
your negligence or the negligence of any person accessing the products you are receiving using your password or access key or by your invitation;
faults as a result of your software being incompatible with a product, service or feature; or
faults with your equipment that have not been caused by us.
Variation to quoted price
Where the quoted price will be impacted as a result of any change to any matters not included in the scope of our engagement, we will be entitled to charge you reasonable additional fees which relate solely to these factors provided that:
we notify you as soon as possible after we become aware of one of these factors occurring; and
we tell you what additional fees will be charged.
Financial Security
At any time, we can require you to provide some form of security (e.g. a security deposit, a charge or bank guarantee) or pay some or all of the charges for your service in advance. If you do not, we can refuse to provide you the service or cancel it.
If you cancel all your services, we return the security deposit or advance payment to you less any outstanding charges.
Our acceptance of any form of security or advance payment does not affect any other terms of these Terms.
We shall be entitled to retain by way of lien any funds, property, papers or data of yours which are in our power, possession or control until all costs, disbursements, interest or other monies due to us have been paid, notwithstanding that our retainer may have ceased.
Subcontracting
Warranty
We cannot guarantee that the Services will produce particular results or outcomes for you. If we are engaged as an expert witness, we do not warrant the outcome of any case. We remain bound by our overarching obligations to the Court to present our evidence without bias.
We do not accept responsibility or liability for defects in a Service that result from your instructions, inputs and/or materials.
We aim to meet the scheduled timeframes and delivery dates set out in the Order. Any indications given by us with respect to the delivery dates are estimates only and may vary.
Security
We aim to keep your products secure so that your use of and the data you transfer to and/or from your products is not visible to unauthorised third parties. We do not, however, guarantee such protection. We will not be liable for the actions of unauthorised third parties obtaining data or access to data in our possession.
We aim to protect our equipment and service platform against intrusions, viruses, Trojan horses, worms, time bombs and other similar harmful software which may affect your service, as well as vulnerabilities which may expose our equipment and service platform to the risk of intrusion or attack. We do not, however, guarantee such protection and will not be liable for any loss that may result to you or third parties.
Service Software
We use software to provide many of the products provided and we do not guarantee that such software is error-free.
As part of your service, we may provide you with a non-exclusive, non-transferable licence to use certain software or may give you access to software as a service (“Service Software”) for the sole purpose of you accessing and using your Service (including any software service).
Intellectual property rights
If we provide you with any documents, processes, service configurations or software as part of your Service, we (or our licensors) will:
continue to own the Intellectual Property Rights in those materials; and
grant you a non-exclusive, non-transferable licence to use that material solely for purposes required to use the products, services and features you are receiving.
If you provide us with material relevant to your products, you grant us a non-exclusive, non-transferable licence to use that material for purposes for or relating to the provision of your products, services or features.
Your obligations
You must ensure that we are informed of all matters relevant to our engagement, including but not limited to:
Any Court orders that may apply to our engagement or the use of any data;
Our obligations to third parties or to a Court, including obligations relating to confidentiality, retention of data, possession of data and chain of title;
Any usual risks that our staff may face, including hostile opponents, and objectionable data content such as pornography or depictions of violence; or
Any other matters that may impact on the price of our services, the amount of work to be done to complete our services or the safety of our representatives.
You must comply (and ensure that your users comply) with all licence terms applicable to the Service Software.
Except as permitted by law, you must not (and you must ensure that your users do not):
remove any copyright, trademark or similar notices on the Service Software;
attempt to reverse engineer, decompile, disassemble, or derive any part of the source code of the Service Software; or
modify, translate, or create derivative works based on the Service Software.
You must take steps to prevent unauthorised access to your service and our service platform, for example, by not disclosing security credentials (such as usernames and passwords) related to your products (except as required by such product).
You must install Service Software, other software, upgrades and patches as directed by us (including allowing us to install certain Service Software). If you fail to do so, we may suspend or refuse to support your service.
Indemnity
You indemnify us against all loss, liability, cost or expense, suits or proceedings arising as a result of or in connection with any third-party claim that relates to the provision (or lack of provision) of our Services, including but not limited to:
the seizing, access to, imaging or copying of third-party property or data;
your data (including any data stored on our storage platform); or
arising as a result of or in connection with your use of the products you are receiving pursuant to our engagement letter.
You acknowledge that in the circumstances of an incident, timing and reliance by us on your obligations are critical and you indemnify us against (and must pay us for) any costs (including legal costs) relating to your breach of these Terms.
Our personnel
Where our personnel perform the Services at your premises or at any location other than our offices, you will ensure that the premises comply with all applicable health, safety, environment and community laws and regulations.
You warrant that your premises have current and compliant COVID-safe plans, and that you have obtained all necessary permissions and approvals for our staff to attend your premises.
Responsibility for your inputs
You warrant that you have the full authority of the owners of copyright material in your possession for us to copy and interrogate that material. You must immediately inform us if you become aware of any infringement or suspected infringement of our Intellectual Property Rights.
You are responsible for any loss, damage, liability, costs or expenses incurred by us as a result of a claim that any inputs or material provided by you or its use by us in accordance with your Services infringes the Intellectual Property Rights of any person.
Take Down Notices and Directions
Termination
We may suspend our Services with immediate effect if we reasonably believe that you are in breach of these Terms.
We may cancel our Services:
at our absolute discretion by giving at least 30 days’ notice;
if we believe in our reasonable opinion that you are in breach of these Terms;
if providing the Services to you may be illegal or we anticipate that it may become illegal; or
if you become bankrupt or insolvent or appear likely to do so.
Your Data
If we store your data as part of your Services, you grant us a licence to host or store your data for all purposes required for or related to our provision of Services.
Subject to all accounts being paid in full, we will provide you with a copy of your data on request. We will permanently delete your data on your request.
Privacy
Outages
We will endeavour to carry out scheduled maintenance where we need to implement an emergency outage to perform urgent work without affecting your products, services or features. However, your products, services or features may not be available during these periods
If we are required to perform emergency maintenance on our service platform, then we will endeavour to inform you as soon as possible. Your Services will not be available during an emergency outage. We aim to provide you with as much notice as possible before an emergency outage.
The following additional terms and conditions contained in this Schedule 7 apply to the provision of Services only where the Customer is purchasing Managed Services, including OVM, or Managed XDR NGSIEM, or (see Schedule 8 for Sovereign Managed Services)
OVM Service
The Orchestrated Vulnerability Management (OVM) Service provides a centralised approach to identifying, prioritising, and remediating vulnerabilities across digital infrastructure. By leveraging automation and orchestration, OVM streamlines the vulnerability management process, reducing the time between detection and resolution.
OVM Platform
Log Files collected from scanners and other vulnerability detection software is ingested into the Sekuro OVM Platform via encrypted API, where the third-party software Nucleus is used to analyse the Log Files to detect vulnerabilities.
The Nucleus terms apply to the OVM Platform and prevail in the case of inconsistency with any other term of this Agreement: https://nucleussec.com/wp-content/uploads/2022/04/20220427-Nucleus-pass-through-MSA-online.pdf
Managed XDR NGSIEM Service
The Managed XDR NGSIEM Service is designed to combine CrowdStrike’s NextGen SIEM platform, with Sekuro’s human skills and expertise, to deliver a world class managed extended detection and response service.
NGSIEM Platform
The Customer acknowledges and accepts that it’s Log Files will be routed to, and hosted in CrowdStrike’s AWS tenancy in the United States, or other locations, as notified by CrowdStrike.
The CrowdStrike terms apply to the NG SIEM Platform and prevail in the case of inconsistency with any other term of this Agreement: https://www.crowdstrike.com/terms-conditions/
Customer Obligations
The Customer must nominate a manager who is appointed to manage the Customer’s obligations with respect to service onboarding.
The Customer must provide assistance to Sekuro (including but not limited to access to physical sites, networks, infrastructure, documentation, licence information, Customer Material and employees and contractors) to the extent reasonably necessary to enable Sekuro to perform the Managed Services.
Except for specific, associated Hardware or Software Services that the Customer is also procuring from Sekuro, that relate to the Managed Services, the Customer is responsible for procuring and maintaining all software, telecommunications, network and computer equipment required to create the Log Files.
The Customer acknowledges and accepts that Sekuro has no control of the content of the Log Files. Should the Customer require that any of its confidential, private, or personally identifiable information be excluded from the OVM Platform, or NGSIEM Platform, then it alone is responsible for ensuring that the Log Files do not contain data of that nature.
If a verification or usage report reveals that the Customer has exceeded the purchased capacity or usage limits specified in an Order, then Sekuro will have the right to recover any resulting fees, payable in accordance with the terms of this Agreement. Without limiting our foregoing rights, Sekuro may work with you to reduce usage so that it conforms to the applicable usage limit, and will in good faith discuss options to right size the subscription as appropriate.
Where the Customer permits or authorises it’s employees, consultants, contractors, or agents to access the OVM Platform or NGSIEM Platform, the Customer will be responsible for any of their actions that affect the viability, security, and usage of the Managed Services.
Term & Termination
Unless otherwise agreed by the Parties in writing, The Managed Services, will start on the earlier of the date that Service onboarding has been completed, or 12 weeks after the date that the Order was signed.
The Customer may terminate the services by providing 90 days notice and paying any post-termination third-party software licence fees for the remainder of the term specified in an Order.
The following additional terms and conditions contained in this Schedule 7 apply to the provision of Services only where the Customer is purchasing Managed XDR Sekuro Private Cloud (Managed XDR SPC) or Log Management as-a-Service (LMaaS) under an Order.
Managed XDR SPC Service
Log Management as-a-Service
The SPC Platform
In providing the Managed XDR SPC and LMaaS Services, the Customers Log Files will be ingested into the SPC Platform, where the software and infrastructure referred to below will be utilised. The third-party terms referred to below apply to the provision of that aspect of the Managed XDR SPC / LMaaS Services and prevail in the case of inconsistency with any other term of this Agreement:
In respect of hosting of the Log Files: AWS – [https://aws.amazon.com/service-terms/]
In respect of routing of the Log Files: Cribl – [https://cribl.io/legal/cribl-subscription-services-agreement/]
In respect of the management of the Log Files: CrowdStrike – [https://www.crowdstrike.com/terms-conditions/]
Sekuro will not intentionally delete any Log Files from the SPC Platform. However, unless explicitly specified in an Order, Sekuro is under no obligation to backup the Log Files, and therefore will not be liable for any loss or corruption of Customer Data ingested into the SPC Platform.
Customer Obligations
The Customer must identify a manager who is appointed to manage the Customer’s obligations with respect to service onboarding.
The Customer must provide assistance to Sekuro (including but not limited to access to physical sites, networks, infrastructure, documentation, licence information, Customer Material and employees and contractors) to the extent reasonably necessary to enable Sekuro to perform the Managed Services.
With the exception of specific, associated Hardware or Software Services that the Customer is also procuring from Sekuro, that relate to the Managed Services, the Customer is responsible for procuring and maintaining all software, telecommunications, network and computer equipment required to create the Log Files.
The Customer acknowledges and accepts that Sekuro has no control of the content of the Log Files. Should the Customer require that any of its confidential, private, or personally identifiable information be excluded from the SPC Platform, then it alone is responsible for ensuring that the Log Files do not contain data of that nature.
If a verification or usage report reveals that the Customer has exceeded the purchased capacity or usage limits specified in an Order, then Sekuro will have the right to recover any resulting fees, payable in accordance with the terms of this Agreement. Without limiting our foregoing rights, Sekuro may work with you to reduce usage so that it conforms to the applicable usage limit and will in good faith discuss options to right size the subscription as appropriate.
Where the Customer permits or authorises it’s employees, consultants, contractors, or agents to access the SPC Platform, the Customer will be responsible for any of their actions that affect the viability, security, and usage of the Managed Services.
Term & Termination
Unless otherwise agreed by the Parties in writing, The Managed Services, will start on the earlier of the date that Service onboarding has been completed, or 12 weeks after the date that the Order was signed.
The Customer may terminate the services by providing 90 days notice and paying any post-termination third-party software licence fees for the remainder of the term specified in an Order.
In the spirit of reconciliation, Sekuro acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their Elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today. We also extend our respect to all the indigenous peoples of the planet.
Website design by Mindesigns
Co-Founder of Macquarie Technology
Aidan is co-founder of Macquarie Telecom and has been a director since 1992. He is the Managing Director of Macquarie Government & Hosting Group with a focus on business growth, cyber security and customer satisfaction.
Aidan has been responsible for the strategy and execution of the investment in Intellicentre 4 & 5 Bunkers, Macquarie Government’s own purpose-built Canberra data centre campus. This facility is leveraged to deliver Secure Cloud Services and Secure Internet Gateway.
With a unique pan-government view on the cyber security landscape, we are invested in leading the contribution from the Australian industry on all matters Cyber policy related.
Aidan holds a Bachelor of Commerce Degree.
CISO, Insignia Financial
James is a leader with a range of experience across various cyber security, technology risk and audit domains, bringing a global lens across a diverse background in financial services, telecommunications, entertainment, consulting and FMCG (Fast Moving Consumer Goods). He is currently the General Manager – Cyber Security at Insignia Financial and most recently was at AARNet (Australia’s Academic and Research Network) where he oversaw a managed Security Operations Centre (SOC) capability for Australian universities. Prior to this James was the acting Chief Information Security Officer for Belong and led the cyber governance and risk team at Telstra.
CEO, Sekuro
Noel is a driven and award-winning IT leader. He has a passion for developing great teams and accelerating client innovation, and in enabling organisations to create a secure and sustainable competitive advantage in the digital economy. Noel also hosts the ‘Building Resilience Podcast,’ which explores the world of sport and deconstructs the tools and ethos of world-class athletes that can help create growth and optimise business and life.
Bid Manager, Sekuro
Audrey is an innovative cybersecurity professional with a versatile profile spanning across Product Management, Presales and Delivery. She has worked within organisations from start-ups to large international organisations in Europe and APAC before joining Sekuro.
Principal Consultant, CRP and OT
Nico leads Sekuro’s Cyber Resilience Program and OT Cybersecurity, ensuring continuous support and effective program execution for our clients. With over a decade in the security industry, including the creation and leadership of several Security Programs for IT and OT across Australia, New Zealand, Argentina, Chile and the US, his core philosophy emphasises an equal balance of people, process, and technology in delivering actionable and simple solutions.
Chief Financial Officer, Sekuro
Trent is a seasoned CFO with over 30 years’ experience in Finance. Trent has broad experiences across Capital raises, debt financing, M&A and business transformation. He is a CPA and member of AICD. Trent works with Boards around risk and risk mitigation plans and assists Boards in navigating the risk mitigation versus cost conversation.
CEO and Board Director, Rich Data Co
Ada is the CEO and Co-founder of Rich Data Co (RDC). RDC AI Decisioning platform provides banks the ability to make high-quality business and commercial lending decisions efficiently and safely. With over 20 years of global experience in financial services, software, and retail industries, Ada is passionate about driving financial inclusion at a global scale.
Before launching RDC in 2016, Ada led a Global Client Advisor team at Oracle Corporation, where she advised Board and C-level executives in some of the largest banks globally on digital disruption and fintech strategy. She also drove Oracle’s thought leadership in banking digital transformation for Global Key Accounts. Previously, Ada implemented a multi-million dollar program to deliver a mission-critical services layer for Westpac Bank in Australia and formulated the IT strategy that was the basis of an $800m investment program to transform Westpac’s Product and Operation division and complete the merger with St. George Bank. Ada is an INSEAD certified international director and holds an EMBA from the Australia Graduate School of Management, and a Master of Computer Engineering from the University of New South Wales, Australia. She also graduated from the Executive Insight Program at Michigan University Ross Business School and IESE Business School.
Chief Executive Officer, Governance Institute of Australia
Megan Motto is Chief Executive Officer of Governance Institute of Australia, a national education provider, professional association and leading authority on governance and risk management. The Institute advocates on behalf of professionals from the listed, unlisted, public and not-for profit sectors.
Megan has over 25 years of experience with large associations, as a former CEO of Consult Australia, as well as holding significant positions in Australia’s built environment sector and business chambers.
She is currently a director of Standards Australia, a member of the ASIC Corporate Governance Consultative Panel and a councillor of the Australian Chamber of Commerce and Industry (ACCI) where she chairs the Data, Digital and Cyber Security Forum.
Megan’s expertise spans governance, risk management, public policy and education. She holds a Bachelor of Arts/Bachelor of Education, a Masters of Communication Management and a Graduate Diploma of Corporate Governance and Risk Management. She is a Fellow of the Governance Institute of Australia, the Chartered Governance Institute and the Australian Institute of Company Directors and is also a member of Chief Executive Women. Megan is also an Honorary Life Trustee of the Committee for Economic Development of Australia (CEDA) and was a 2014 recipient of the AFR/Westpac 100 Women of Influence.
Chief Growth Officer, Sekuro
Sekuro’s Chief Growth Officer, Shamane Tan, is passionate about uniting minds and experiences, excelling in aligning C-Suite and Board members with cyber security imperatives. As the author of “Cyber Risk Leaders,” she unravels executive communication nuances and distils C-Suite expectations.
Her work extends to “Cyber Mayday and the Day After,” a roadmap for navigating crises by mining the wisdom of C-level executives from around the globe. It’s filled with interviews with managers and leaders who’ve braved the crucible and lived to tell the tale. Her most recent book, “Building a Cyber Resilience: A Cyber Handbook for Executives and Boards,” was featured on Forbes Australia’s top list of books for CEOs.
Shamane has also founded a transcontinental cyber risk and executive meetup spanning Sydney, Melbourne, Adelaide, Perth, Singapore, the Philippines, and Tokyo, fostering mentorship, women’s empowerment and thought leadership. As a strong advocate for the importance of having a voice and helping others use theirs, Shamane Tan has spoken at TEDx and global conferences, including FS-ISAC, RSA, Silicon Valley, Fortune 500 and ASX companies.
Recipient of the IFSEC Global Top 20 Cybersecurity Influencer award and named among the 40 under 40 Most Influential Asian-Australians, Shamane leverages her unique fusion of technical prowess and business acumen to help organisations progress on their security maturity journey.
David Gee, CIO, CISO, NED, Board Advisor & Author
David has just retired in July 2024 and is building out his portfolio. He is an Advisor with Bain Advisory Network and also an Advisor to JS Careers (Cyber Recruitment) and Emertel (Software Commercialisation).
He is a seasoned technology executive with significant experience and has over 25 years’ experience in CIO and CISO roles across different industries and countries. At Macquarie Group David served as Global Head Technology, Cyber and Data Risk. Previously was CISO for HSBC Asia Pacific. His career as a CIO spans across multiple industries and geographies including – Metlife, Eli Lilly and Credit Union Australia. He was winner CIO of the Year 2014, at CUA where he successfully completed a significant Transformation of Core Banking, Online and Mobile Banking systems.
David is past Chairman for the FS-ISAC Strategy Committee and awarded Global Leaders Award in 2023 for his contributions to the cyber security industry. A regular conference keynote speaker and 150+ published articles for CIO Australia, Computerworld, iTnews and CSO (Cyber Security), David now writes for Foundry CIO.com and AICD.
His most recent book – the Aspiring CIO & CISO was published in June 2024 and David is writing his second – A Day in the Life of a CISO with a number of CISOs from around the world for 2025.
Co-founder, Big Red Group and Former Shark Tank Judge
INTRODUCTION
For 25 years as an entrepreneur, Naomi Simson has been bringing people together whether it’s with her business experience, her speaking or writing. Passionate about small business and local community, Naomi is considered a home grown success story.
Naomi had a corporate career with Apple, KPMG, IBM and Ansett Australia prior to becoming an entrepreneur. She is a prolific blogger, podcaster and business commentator, and appeared as the #RedShark in four seasons of Shark Tank Australia and she appears regularly on ABC The Drum. She is a non-executive director at Big Red Group, Australian Payments Plus, Colonial First State and Weebit Nano, as well as the Cerebral Palsy Research Foundation and the University of Melbourne Business and Economics Faculty.
A true business leader and influencer, with more than 2.7 million LinkedIn followers, Naomi is Australia’s most followed person on the business networking platform. She has four seasons of her podcast ‘Handpicked’, and she has authored two best-selling books Live What You Love, and Ready to Soar, and is sought after speaker.
FULL BIO
For 25 years Naomi has been bringing people together whether it’s with her business experience, her speaking or writing. She is a strong advocate of business owners.
Known as an entrepreneur and business leader; following the growth of RedBalloon which she founded in 2001, Naomi co-founded the Big Red Group (BRG) in 2017.
Naomi had a corporate career with Apple, KPMG, IBM and Ansett Australia prior to becoming an entrepreneur. She is a prolific blogger, podcaster and business commentator, and appeared as the #RedShark in four seasons of Shark Tank Australia. She is a non-executive director at Big Red Group, Australian Payments Plus, Colonial First State and Weebit Nano. As well as the Cerebral Palsy Research Foundation and the University of Melbourne Business and Economics Faculty.
A true business leader and influencer, with more than 2.7 million LinkedIn followers, Naomi is Australia’s most followed person on the business networking platform. She has authored two best-selling books Live What You Love, and Ready to Soar, and is an engaging, humorous and insightful speaker. She has four seasons of her Podcast – Handpicked.
Naomi is relatable across a broad variety of audiences and topics, often drawing on her personal experiences to provide thoughtful and valuable views into topics; including the customer obsession, intentional leadership, growth mindset, personal development. She is a regular panellist on ABC The Drum.
Product Line Manager, Global Certifications, Palo Alto Networks
Peter leads the Commercial Cloud, Global Certifications organisation at Palo Alto Networks which oversees global cloud security compliance efforts to various frameworks and standards including IRAP, SOC 2, ISO, PCI, C5, ISMAP, and IRAP and more for 25+ cloud products.
He has held many roles over the years covering areas of IT Operations, and Governance, Risk, & Compliance (GRC) for a wide range of industries including technology, insurance, and manufacturing.
Peter holds various security and professional certifications, including the CCSP, CISSP, PCI ISA, CISA, CISM, CDPSE & ISO Lead Auditor, in addition to a Master of Science degree in Information Assurance.
CISO, QUT
Jack Cross is an experienced business leader with expertise in digital technologies and risk management. Through a steadfast commitment to integrating people, processes, and technology, he champions the fight against cyber threats while mitigating organisational risks.
Over the past 15 years, Jack has navigated diverse leadership roles within the Defence and Education sectors, honing his skills in steering multidisciplinary teams through intricate and sensitive technical landscapes. In addition to this experience, he holds numerous formal qualifications such as: a Master of Systems Engineering (Electronic Warfare); CISSP; and CISM certifications.
Global CTO, Infotrack
Nadene Serman is a leading IT executive with a proven track record spearheading first-of-its-kind technology and business transformation for some of the most prominent organisations globally and in Australia. As the Global Chief Technology Officer of InfoTrack, she is a key protagonist of innovation as an enabler of InfoTrack’s next stage growth. Her energy, commercial acuity and strategic capability have fueled her success.
Nadene leads with clarity, transparency and urgency, uniting people in complex, multi-layered technology and business execution, and go-to-market transformation and innovation. She tackles and resolves complex and seemingly intractable challenges while building support and collaboration – even in times of crisis. Her people-first, ‘think straight, talk straight’ approach makes her a formidable force.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
