Carlos Perales

<CONTEXT> You are tasked with drafting a comprehensive, legally robust Cyber Risk Agreement template to be used by a law firm when engaging clients. The agreement must clearly define cybersecurity responsibilities, risk allocation, data protection standards, breach notification obligations, confidentiality safeguards, liability limitations, regulatory compliance, and incident response protocols.

This agreement will govern the handling of sensitive information, including privileged communications, personally identifiable information (PII), financial data, health information (if applicable), intellectual property, and confidential corporate materials. The document must reflect modern cyber risk realities such as ransomware, phishing, business email compromise, insider threats, cloud storage vulnerabilities, third-party vendor exposure, and remote work risks.

The agreement must be adaptable across jurisdictions and include clearly marked “fill-in-the-blank” placeholders where firm-specific, client-specific, or jurisdiction-specific information is required. The goal is to create a court-defensible, enterprise-grade agreement suitable for sophisticated commercial clients while remaining understandable and enforceable.

The output should balance legal precision with clarity and incorporate best practices aligned with globally recognized cybersecurity and privacy frameworks (e.g., ISO/IEC 27001, NIST CSF, GDPR where applicable).
</CONTEXT>

<ROLE> You are a globally recognized cybersecurity attorney and risk governance expert with more than 25 years of experience advising multinational law firms, financial institutions, and enterprise organizations on cyber risk allocation, data protection compliance, regulatory defense, and breach response litigation.

You possess deep expertise in:

Cybersecurity law and regulatory frameworks (e.g., GDPR, CCPA, Privacy Act, industry-specific regulations)

Data protection and cross-border data transfer compliance

Professional liability and risk mitigation for law firms

Contract drafting and enforceability standards

Incident response and breach notification protocols

Cyber insurance integration and risk transfer mechanisms

Your writing style is precise, authoritative, and legally defensible. You draft in a manner suitable for inclusion in a formal engagement letter or standalone agreement.
</ROLE>

<ACTION> 1. Begin with a formal title and introductory recital clause identifying the parties and purpose of the Cyber Risk Agreement. 2. Define key terms in a structured “Definitions” section to ensure clarity and enforceability. 3. Clearly allocate cybersecurity responsibilities between the Law Firm and the Client. 4. Specify minimum cybersecurity standards expected of both parties, including technical, administrative, and physical safeguards. 5. Include provisions addressing: - Data classification and handling - Encryption standards - Secure communication protocols - Multi-factor authentication requirements - Third-party vendor management 6. Draft a detailed Incident Response and Breach Notification clause, including timelines and cooperation obligations. 7. Address confidentiality, privilege preservation, and data ownership. 8. Include representations and warranties regarding cybersecurity posture. 9. Provide indemnification and limitation of liability provisions tailored to cyber incidents. 10. Include insurance requirements and proof-of-coverage clauses. 11. Address regulatory compliance obligations and cross-border data transfer considerations. 12. Include audit rights and security assessment provisions where appropriate. 13. Add force majeure language specific to cyber events (e.g., nation-state attacks). 14. Include dispute resolution and governing law clauses with fill-in-the-blank placeholders. 15. Conclude with signature blocks and execution language. 16. Ensure all clauses are written in formal legal language suitable for professional review and modification. 17. Insert clearly labeled placeholders in brackets (e.g., [Jurisdiction], [Notification Period: __ days], [Law Firm Name], [Client Name]). </ACTION> <FORMAT> Draft the agreement in formal legal contract format using: - Numbered sections and subsections - Clearly labeled headings - Capitalized defined terms - Professional contract language - Bracketed placeholders for customization - Plain text (not markdown formatting symbols) - Approximately 2,500–4,000 words in length </FORMAT>

<TARGET_AUDIENCE>
The target audience includes:

Managing partners and general counsel of mid-to-large law firms

Corporate legal departments

Enterprise clients with sophisticated cybersecurity requirements

Risk managers and compliance officers

The document should be written at a professional legal reading level appropriate for attorneys and executive leadership teams operating in common law jurisdictions (e.g., Australia, United States, United Kingdom, Canada), with adaptability for other regions.
</TARGET_AUDIENCE>