Membership Agreement

(Funded Single Organization – State/Territory Wide)

This Membership Agreement (“Agreement”) is between the Multi-State Information Sharing and Analysis Center, a division of Center for Internet Security, Inc., a Maryland nonprofit corporation (“MS-ISAC”), located at 31 Tech Valley Drive, East Greenbush, NY 12061-4134, and the entity accepting the Agreement (“Member”).

By joining the membership of the MS-ISAC, Member acknowledges and agrees to the following terms and conditions:

1. Charter and Information Exchange. By accepting this Agreement, Member agrees to the MS-ISAC Charter as set forth at https://portal.cisecurity.org/ms-isac-charter and the MS-ISAC Terms and Conditions for Information Exchange as set forth at https://portal.cisecurity.org/ms-isac-terms-and-conditions-for-information-exchange. The MS-ISAC Charter and MS-ISAC Terms and Conditions are incorporated by reference herein and may be updated from time to time by MS-ISAC.

2. Member in Good Standing. Member represents that Member meets the eligibility requirements for membership in the MS-ISAC as set forth in the Charter. Member is required to remain in good standing during the term of Member’s membership in MS-ISAC. For purposes of this Agreement, “good standing” means (1) the state/territory funding this membership (“State/Territory”) has paid the annual membership fees, (ii) Member has not violated and continues to comply with terms of the Agreement, and (iii) Member continues to meet the eligibility requirements of MS-ISAC membership. Member agrees to promptly notify MS-ISAC if Member becomes aware that its eligibility status has changed.

3. Membership Benefits. Subject to Member’s compliance with the terms of this Agreement, MS-ISAC will provide Member with the membership benefits identified in Schedule A during the term of the Agreement. MS-ISAC may make changes to the membership benefits. Any material changes to the membership benefits will be made in consultation with the MS-ISAC Executive Committee. MS-ISAC will provide Member with written notice at least thirty (30) days prior to the effective date of a material change.

4. Member Contact Information. Member authorizes MS-ISAC to provide Member’s contact information identified in Schedule B to the State/Territory.

5. Member Data with Attribution. Member authorizes MS-ISAC to provide Member’s data with attribution (as identified in the State/Territory unique terms and conditions agreed to by Member) to the State/Territory.

6. Term and Termination. The term of this Agreement will be for one (1) year from the Effective Date unless earlier terminated as provided herein and will automatically renew annually thereafter. Either party may terminate this Agreement: (i) if the other party breaches a material obligation under this Agreement and fails to cure such breach within thirty (30) days following written notice or (ii) for convenience by providing at least thirty (30) days written notice to the other party. Upon termination, Member will cease use of the Member Benefits as of the date of such termination. No refunds will be issued for termination for convenience by Member or termination for cause by MS-ISAC. In the event of termination for cause by Member or termination for convenience by MS-ISAC, Member will be entitled to a prorated refund of any unused membership fees or membership renewal fees that have been paid by Member to MS-ISAC.

7. Ownership of Intellectual Property. MS-ISAC owns all rights, title, and interest in and to MS-ISAC’s name, trademarks, and logos (collectively “Marks”). Member acknowledges that Member shall not use such Marks without prior written consent from MS-ISAC.

8. Representation and Warranty. Member represents and warrants that the individual completing the MS-ISAC membership application and accepting the Agreement has the authority to enter into a binding agreement on behalf of Member. All benefits, products, services, and activities provided by MS-ISAC to or for the benefit of members are provided on an “as is” basis without warranty of any kind, either express or implied.

9. Limitation of Liability. Neither MS-ISAC nor Member will be liable to the other for any consequential, indirect, special, exemplary, punitive, or incidental damages, whether foreseeable or unforeseeable, however caused, arising out of or in connection with Member’s membership in MS-ISAC, or any products, services, and activities provided to or engaged by Member in connection therewith. The aggregate liability of MS-ISAC or Member for all claims arising in connection with Member’s membership will not exceed the total amount of membership fees paid by Member during the most recent twelve (12) months of membership.

10. Force Majeure. Neither party shall be liable for any delay or failure in performance due to causes beyond its reasonable control.

11. Assignment. MS-ISAC may assign this Agreement without prior written consent from Member. This Agreement shall be binding upon and inure to the benefits of each party and their respective successors and assigns.

12. Notices. Any notice required or permitted to be given under this Agreement shall be given in writing and shall be sent by certified mail, registered mail, or overnight courier service to (i) Member at the address provided by Member during the registration process and (ii) MS-ISAC at the below address:

MS-ISAC

31 Tech Valley Drive

East Greenbush, NY 12061

Email: legalnotices@cisecurity.org

Attention: Legal Department

13. Applicable Law. This Agreement will be governed and construed in accordance with the laws of the State of New York without regard to its conflict of law provisions. Any disputes related to this Agreement shall be brought in the federal or state courts located in New York.

14. Severability. If any court of competent jurisdiction considers any provision of this Agreement to be invalid, illegal, or unenforceable, such provision(s) shall be considered severed from this Agreement. All other provisions, rights, and obligations shall continue without regard to the severed provision(s).

15. Entire Agreement. The provisions of this Agreement, including all documents incorporated herein by reference, such as the MS-ISAC Charter, MS-ISAC Terms and Conditions for Information Exchange, and other applicable terms and conditions, constitute the entire agreement between the parties and supersede all prior agreements and understandings relating to the subject matter hereof.

By accepting this Agreement, Member certifies that Member has read and agrees to comply with the above terms and conditions as of the Effective Date.

Schedule A

MS-ISAC Membership

Threat Intelligence and Distribution

· SLTT Specific Threat Intelligence Analysis Products and Reporting

· MS-ISAC Threat Intelligence Platform STIX/TAXII and MISP Access

· Virtual Threat Intelligence Briefings (SLTT threat brief)

Member Collaboration and Engagement

· Exclusive access to a collaborative peer community

· 1:1 service consultations with CIS cybersecurity experts

· MS-ISAC Annual Membership Meeting

· Monthly membership calls

· Best practice webinars led by experienced peers and top experts

· SLTT mentorship program

Benefits

Incident Response & Forensic Services

· MS-ISAC Incident Response & Forensic Services (as resources allow)

Security Operations Center (SOC)*

· 24x7x365 SOC Access
SOC Alerts, Advisories, Weekly Malicious IP/Domain List

· Passive Threat Notification Service

– Targeted Vulnerability Notifications
Initial Access Broker (IAB) Monitoring

– Breached Credential Monitoring

– IP and Domain Monitoring

Services and Programs*

· Malicious Domain Blocking and Reporting (MDBR)

· Annual cybersecurity self-assessment (NCSR)

Schedule B

Member’s Contact Information

o Member entity name

o Primary contact name

o Primary contact title

o Email address

o Date of opt-in date to state/territory membership

o County (where applicable)

o Sector

White Papers

CIS Controls v8.1 Mapping to Health Insurance Portability and Accountability Act (HIPAA), Regulation Text, 2013