The Evaluation Services
1. The Evaluation Services are those services (if any) NCSC provides to you (the organisation requesting assistance or, where appropriate, the individual) in relation to evaluation of the cyber security incident you have reported to NCSC.
2. The Evaluation Services may include using NCSC tools to analyse any information or hardware you provide to NCSC.
3. NCSC will endeavour to report to you on the results of any Evaluation Services NCSC provides. NCSC will determine the form and content of any such report.;
Application of these terms and conditions
4. These terms and conditions apply to any Evaluation Services NCSC may provide you in relation to the cyber security incident you have reported to NCSC.
5. These terms and conditions form part of a legally binding agreement between the Government Communications Security Bureau (acting through NCSC) and you.
6. The agreement begins when NCSC advises you it will provide Evaluation Services in relation to the incident you have reported to NCSC and you have submitted this completed Cyber Security Incident – Request for Assistance Form (the Form).
Your ability to provide information to NCSC
7. You have the authority to provide the information and hardware listed in the Form to NCSC so that NCSC can provide you with Evaluation Services. This includes the authority to provide NCSC with communications of people who use your systems and information that may be considered personal.
8. The persons identified as your contact persons in the Form are authorised to act and make decisions on your behalf in relation to any Evaluation Services provided by NCSC.
9. The following information must only be disclosed to those people within your organisation who have a need to know the information:
(a) any information that NCSC provides to you during or after providing you with the Evaluation Services, including any reports on the result of the Evaluation Services; and
(b) the fact that NCSC is providing you with the Evaluation Services.
10. The information identified in clause 9 above may only be disclosed outside of your organisation where required by law, or with the consent of NCSC. You will consult with NCSC before you make any disclosure outside of your organisation required by law.
11. You must also comply with any specific instructions NCSC gives you about how to handle any information NCSC provides to you, including any reports.
12. NCSC may require individual persons within your organisation, including identified contact people, to sign non-disclosure agreements before NCSC provides information to those persons.
13. You will notify NCSC of any breaches of clauses 9 to 12.
How NCSC will protect and use your information.
14. NCSC will store the information or hardware provided by you for up to 12 months from the date of receipt, except where that information or hardware is associated with malicious activity or with indicators of malicious activity, which NCSC may store indefinitely.
15. NCSC may use information or hardware provided by you and analysis of your information or hardware in reports about information assurance and cyber security provided to other entities.
16. Unless you agree, NCSC will not disclose any information or hardware, or any analysis of information or hardware to another entity that would readily identify any authorised user of your systems.
Limitation of liability and indemnity
17. The following limitations of NCSC’s liability apply, as far as they are permitted by law:
(a) NCSC has no liability to you in respect of any loss or damage that you might suffer as a result of any evaluation service provided to you by NCSC; and
(b) NCSC excludes any express or implied warranties in relation to any Evaluation Service provided to you.
18. You indemnify NCSC in respect of any damage, liability, or related expenses that NCSC incurs as a result of any evaluation service provided to you by NCSC.
19. Clause 18 does not apply if you are a Crown department or agency.
When this agreement ends
20. This agreement ends in any of the following situations:
(a) you ask NCSC to stop providing the Evaluation Services;
(b) NCSC decides to stop providing the Evaluation Services to you and informs you of this decision; or
21. Even after this agreement ends, clauses 9 to 19 above continue to operate.