Support for Palo Alto Networks Strata Cloud Manager is available now. Learn more →

ADDENDUM: DORA Mandatory Terms

This DORA Mandatory Terms Addendum (“Addendum”) shall form part of and is hereby incorporated into the Software Licence and Services Agreement (hereafter referred to as the “Agreement”) entered into between Licensee and FireMon (together referred to as the “Parties”).

1. Introduction

1.1. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) (“DORA”) is EU legislation which entered into force on 16 January 2023 and applies from 17 January 2025. The legislation will affect the Agreement entered into between the Parties.

1.2. This Addendum is an industry template drawn up by members of the proprietary trading industry in order to implement, within the Agreements, the mandatory contractual provisions required by DORA together with the associated Regulatory Technical Standards (“RTS”) (together the “Mandatory Terms”).

1.3 The sole purpose of this Addendum is to incorporate the Mandatory Terms into the Agreement. All other contractual provisions in the Agreement between the Parties remain unaffected. In the event of any conflict between the terms of the Agreement and the terms of this Addendum, the terms of this Addendum shall take precedence.

1.4. Capitalised terms used but not defined in this Addendum shall have the meaning given to them in DORA or the Agreement.

1.5. Based on the nature and use of the Software and related support services as at the effective date of this Addendum, the Parties have mutually determined that the Software and related support services provided by FireMon in connection with the Agreement are not considered to include critical or important function(s) within the meaning of Art 3(22) of DORA. The Licensee shall notify FireMon if this classification changes.

1.6. These Mandatory Terms constitute a legally binding amendment to the Agreement, required to enable the Licensee to comply with its, or its affiliates’, legal obligations. This Addendum shall take effect on the date of the last signature below or, if not signed, on the effective date of the Agreement, and shall be binding on both Parties.

2. Software descriptions and performance monitoring

2.1. The Parties agree that:

  • 2.1.1. the Agreement sets out the functionality, features and related services (the “Software”) to be provided by FireMon to the Licensee.
  • 2.1.2. the Software will be installed on the Licensee’s premises. FireMon is not intended or required to receive, store or process any personal or otherwise sensitive data, or non-personal data as required by DORA, of the Licensee (“Licensee Data”) in connection with the Software or related support services. The Licensee shall not submit or make Licensee Data available to FireMon unless this is necessary and agreed by the Parties.

2.2. FireMon agrees to the following requirements in connection with the Software and related support services:

  • 2.2.1. To the extent that FireMon receives, accesses, stores or otherwise processes Licensee Data in connection with the Software or related support services, FireMon shall maintain appropriate measures designed to protect the availability, authenticity, integrity and confidentiality of such Licensee Data, in accordance with applicable laws and regulations.
  • 2.2.2. To the extent that any Licensee Data is held or processed by FireMon, FireMon shall, upon the insolvency, resolution or discontinuation of FireMon’s business operations, or upon termination of the Agreement, provide for the access, recovery and return of such Licensee Data in FireMon’s possession or control in an easily accessible format.
  • 2.2.3. If an ICT-related incident relating to the Software or related support services occurs, FireMon shall provide the Licensee with reasonable assistance in connection with that incident, at no additional cost or at a cost determined in advance, taking into account the nature and scope of the incident and the services provided by FireMon.
  • 2.2.4. FireMon shall cooperate reasonably with the Licensee’s competent authorities and resolution authorities, and with persons appointed by such authorities, in connection with the Software and related support services, subject to applicable law and reasonable confidentiality, security and access-control requirements.
  • 2.2.5. Where appropriate in light of the Software and related support services provided by FireMon, FireMon shall participate in the Licensee’s relevant ICT security awareness programmes and digital operational resilience training, subject to reasonable advance notice and mutually agreed scheduling and scope.

3. Termination

3.1. Notwithstanding the termination provisions contained in the Agreement, the Licensee may terminate the relevant Agreement with immediate effect in any of the following circumstances:

  • in the event of a significant breach by FireMon of any applicable laws and/or regulations, or a material breach of the terms of this Addendum;
  • in the event that circumstances are identified, in the course of monitoring ICT third-party risk, which are deemed capable of altering the performance of the functions provided by FireMon in accordance with this Addendum, including material changes that may affect the arrangement with, or the situation of, FireMon;
  • where FireMon has evidenced weaknesses relating to its overall ICT risk management or the security of the Software or related support services, including, where applicable, in the way it ensures the availability, authenticity, integrity and confidentiality of Licensee Data, whether personal or otherwise sensitive data, or non-personal data as required by DORA; or
  • where the competent authority can no longer effectively supervise the Licensee as a result of the conditions of, or circumstances relating to, the respective contractual arrangement and/or Agreement.

3.2. Where the Licensee is required by a competent authority or resolution authority to terminate any Agreement, that Agreement may be terminated by the Licensee on 90 days’ prior written notice, unless a shorter notice period applies and/or is required by a competent authority or resolution authority.

4. Miscellaneous

4.1. The Agreement, its amendments and this Addendum constitute the entire agreement between the Parties.

4.2. Where a provision of DORA is superseded or invalidated, or where DORA (including any updates to the Contracting RTS and Subcontracting RTS) requires changes to the terms of this Addendum, the Parties shall, to the extent legally required, negotiate in good faith and document any necessary changes by way of a written amendment to this Addendum in accordance with applicable laws and regulations.

4.3. The laws governing the Agreement also govern the terms supplemented by way of this Addendum, and the courts identified in the Agreement also have jurisdiction over the terms supplemented by way of this Addendum.

4.4. Each Party bears its own costs, responsibilities and liabilities in respect of this Addendum and its implementation.

ADDENDUM: DORA Mandatory Terms | FireMon