Terms of Engagement
A proposed framework for agreeing professional services, responsibilities and deliverables.
Prepared for this private preview. The highlighted business and processing details must be completed before these documents are used on the public business website. This draft is not an assurance of legal compliance.
1 Defining the engagement
Before work begins, VLK and the client agree a written scope covering objectives, systems and entities in scope, deliverables, exclusions, milestones, named contacts and acceptance criteria. The agreement identifies whether the work is an assessment, readiness project or ongoing advisory arrangement.
2 Responsibilities and dependencies
The client provides authorized access, accurate information, relevant evidence and available decision-makers. VLK identifies material limitations in the information reviewed. Recommendations support client decisions; management retains ownership of risk acceptance, operational changes and regulatory obligations.
3 Access and confidentiality
Access is limited to the agreed purpose and authorization. Sensitive material is exchanged through an agreed channel. Confidentiality terms should cover permitted recipients, exceptions, retention, return and deletion. No penetration testing, intrusive scanning or production change is included unless separately authorized in writing.
4 Personal data and tools
Identify controller and processor roles before sharing personal data. Where VLK acts as a processor, agree appropriate processing terms, instructions and safeguards. Identify permitted tools, hosting locations and subcontractors. Client material must not be sent to external AI services without the necessary authorization and data-protection assessment.
5 Fees and changes
The proposal specifies currency, taxes, payment milestones, expenses and any advance payment. Changes to scope, evidence availability or client dependencies may change timing and fees; record the change before additional work starts. This draft does not impose an unagreed rate, deposit or cancellation charge.
6 Deliverables and acceptance
Define the client’s review period, how feedback is consolidated and how material deviations from agreed deliverables are corrected. Distinguish VLK’s pre-existing methods from client-specific outputs and agree usage rights. Third-party standards and software remain subject to their own licenses.
7 Professional boundaries
Services may include advice on applying relevant information security laws, regulations and standards, gap assessments, implementation support and preparation for certification, as agreed in the engagement scope. Certification decisions belong to an independent certification body. Specialist legal interpretation, legal representation or technical work is identified separately where needed. Advisory work does not guarantee certification, full compliance or freedom from incidents.
8 Completion and termination
Agree notice periods, payment for work performed, handover, access revocation and the return or deletion of information. Any ongoing monitoring or update service must be expressly included; a completed assessment is not continuous supervision.
9 Contract-specific provisions
Complete the legal identity of both parties, commencement date, commercial terms, confidentiality and processing schedules, intellectual-property provisions, liability arrangements, insurance requirements if any, governing law and dispute process. Obtain legal review of the final contract. These are proposed engagement principles, not an executed agreement.