1. Scope

1.1 These SecOps Specific Terms apply to the security services that ON DIVERSITY CLOUD EUROPE, S.L. ("DIVERSITY") provides under an Order Form: a managed security operations centre (SOC) and SOC enablement, an incident-response retainer, penetration testing, objective-led red teaming, external attack surface mapping, a fractional CISO, and compliance readiness. They apply whether the Customer's systems are hosted with DIVERSITY or elsewhere.

1.2 These Specific Terms supplement the General Terms (/general-terms/) and the Acceptable Use Policy (/acceptable-use-policy/). They do not repeat what those documents settle. In particular, fees, invoicing and late payment (General Terms, Section 7), personal data (Section 9 and the DPA), confidentiality (Section 10), liability (Section 14), notices (Section 18), and governing law and courts (Section 23) apply as written there.

1.3 Where these Specific Terms depart from the General Terms, they say so and prevail, as Section 3.2 of the General Terms provides. Capitalised terms not defined here have the meaning given in the General Terms.

2. Definitions

  • "Testing": penetration testing, red teaming and external attack surface mapping.
  • "Rules of Engagement": the written rules agreed for Testing under Section 5.2.
  • "Findings": the results of Testing or of the SOC's work, including reports.

3. Managed SOC

3.1 The SOC operates 24 hours a day, 7 days a week. DIVERSITY also helps Customers that run their own SOC (SOC enablement), as the Order Form describes.

3.2 Only DIVERSITY staff located in the European Union see the Customer's logs.

3.3 Logs are stored in DIVERSITY's data centres, for the retention period set in the Order Form.

3.4 The SOC includes the response to an incident: containment as far as the Order Form allows, a call to the contact the Customer has named, and a written report.

3.5 DIVERSITY fixes the Customer's systems only where the Order Form gives it access to them.

3.6 No monitoring detects every threat. DIVERSITY does not warrant that every incident will be detected or prevented.

4. Incident-response retainer

The response times of the incident-response retainer are set in the Order Form.

5. Testing

5.1 Testing is carried out by DIVERSITY's own testers. A retest can be included, as the Order Form states.

5.2 Testing starts only after the Customer has given its written authorisation and the parties have agreed the Rules of Engagement in writing. The Rules of Engagement state at least the systems in scope, the dates, the methods, how far DIVERSITY may go in exploiting known vulnerabilities, the contacts on both sides and when Testing must stop.

5.3 Where a system in scope is owned or operated by someone other than the Customer, the Customer must obtain that party's written authorisation before Testing starts.

5.4 DIVERSITY tests whether known vulnerabilities can be exploited, as far as the Rules of Engagement allow. It does not develop new exploits.

5.5 Testing can affect the availability or performance of the systems tested, even when carried out with care. The Customer must back up those systems before Testing.

5.6 External attack surface mapping is available as a one-off exercise or continuously. It is carried out without sending the Customer's data to services outside DIVERSITY.

5.7 SecOps tests the systems that the Customer runs. DIVERSITY's own infrastructure and platform are never tested under SecOps, and no one may test them (Acceptable Use Policy, Section 3.1).

6. Fractional CISO

6.1 The fractional CISO works for the time stated in the Order Form, which may be a block of hours, a permanent or semi-permanent presence, or a week each month, with an optional 24/7 on-call service.

6.2 The fractional CISO advises and prepares. The Customer's management takes the decisions and remains accountable for them.

7. Compliance readiness

Work on NIS2, DORA, ISO 27001, ENS, the GDPR or any other regime is readiness work. It is not a declaration of conformity or a certificate, and DIVERSITY does not certify the Customer.

8. Findings and data

8.1 Findings are the Customer's confidential information (General Terms, Section 10) and are delivered to the contacts named in the Order Form.

8.2 What happens to logs and to data gathered during Testing at the end of the Agreement is set out in the Order Form.

9. Term and billing

9.1 The term of each SecOps service is stated in the Order Form. Section 16 of the General Terms applies unless the Order Form provides otherwise.

9.2 SecOps services are billed as the Order Form sets out. Prices appear only in the Order Form.

10. Exclusions

SecOps does not include:

(a) drafting or filing regulatory incident notifications, which remain the Customer's;

(b) emergency incident response for organisations that are not Customers;

(c) regulated threat-led testing of financial entities, such as TLPT or TIBER-EU;

(d) any commitment that testers hold a particular certification;

(e) fixes to the Customer's systems where the Order Form gives DIVERSITY no access to them.