Terms & Conditions

Cyber Unit – General Terms and Conditions

1. Performance of Services

1.1 Provision of the Services

(a) These general terms and conditions apply to:

(i) any Proposal or Quote that is submitted to, and is accepted by, the Client; or

(ii) any SOW that references and incorporates these general terms and conditions.

(b) During the Term, Cyber Unit agrees to perform the Services as set out in a Proposal, Quote, or SOW (as relevant), and any acceptance and delivery will only be in accordance with the terms of this Agreement, and no other terms or conditions contained in any other Client document will apply or be incorporated. The Client acknowledges and agrees that the Services may be performed and invoiced by Cyber Unit or any of its Related Bodies Corporate.

(c) When performing any Services, Cyber Unit agrees to:

(i) comply with all reasonable directions of the Client and all applicable Laws in the performance of its obligations.

(ii) comply with all reasonable health and safety policies of the Client while on the Client's site as provided to Cyber Unit prior to commencing the work; and

(iii) use reasonable endeavors to have any specific personnel identified in a Proposal, Quote, or SOW available to perform the Services and will provide the Client with reasonable notice if it intends to replace or reassign such personnel.

(d) The Client agrees to reasonably facilitate Cyber Unit's supply of any Services or Products, including:

(i) providing Cyber Unit with safe and timely access and authorization to access and use the Client's Systems, personnel, facilities, site, and utilities as reasonably required.

(ii) providing Cyber Unit with any requested information relevant to the provision of the Services in a timely and accurate manner.

(iii) ensuring the Client's Systems are virus-free and backed-up prior to, and during, the performance of the Services; and

(iv) complying with all reasonable requests or directions of Cyber Unit.

(e) Client acknowledges that, due to the nature of some Services, Cyber Unit's proper performance of those Services may have an impact on Client's Systems.

1.2 Use of subcontractors

(a) Cyber Unit will be liable for:

(i) the performance of obligations by its subcontractors; and

(ii) provision of the Services by its subcontractors.

1.3 Provision of Products

(a) At any time during the Term, the Client may request to purchase any Products offered for sale or resale by Cyber Unit by submitting a purchase order to Cyber Unit.

(b) The purchase order must explicitly reference these general terms and conditions and set out the type and quantity of the Product/s to be purchased and the desired date for delivery of the Products.

(c) Cyber Unit will provide the Client with written notification of acceptance or rejection of the purchase order, the proposed delivery date along with any variable price changes (including exchange rate, delivery, or third-party pricing changes) as relevant for the purchase of the Products. Failure by Cyber Unit to confirm receipt of the purchase order is not an acceptance of that purchase order.

(d) All risk in any deliverable transfers to the Client upon delivery to the Client, and title passes on payment in full.

1.4 Access and delays

(a) The Client will be responsible for any delays caused or contributed to by the Client, including failure to provide any information or access to any Client premises or Systems necessary for any of the Services at least 5 Business Days prior to commencement of the applicable Services.

(b) If the Client requests Cyber Unit to cancel, delay, reschedule, or suspend the Services with less than 3 Business Days' notice, the Client must pay Cyber Unit its reasonable costs associated with such cancellation, delay, rescheduling, or suspension.

2. Authorisation

The Client authorizes Cyber Unit and Cyber Unit's Personnel to access and use the Client's networks and Systems as reasonably required to provide the Services.

3. Specific Services Terms

To the extent the Services include:

(a) Security Testing Services, the terms in Schedule 1 apply.

(b) Digital Forensic Services, the terms in Schedule 2 apply.

(c) Education Services, the terms in Schedule 3 apply; and

(d) Staff Augmentation Services, the terms in Schedule 4 apply,

and the terms of each relevant schedule will apply to the provision of those Services and take precedence over these terms to the extent of any conflict.

4. Governance Risk, Compliance and Privacy Advisory

(a) The Client is responsible for ensuring that the selection and use of Products and Services satisfy all of the Client's legal, regulatory, and compliance obligations.

(b) Unless set out in a Proposal, Quote, or SOW, Cyber Unit is not responsible for any of the Client's legal, regulatory, or compliance obligations.

5. Term

Unless otherwise terminated in accordance with clause 14, this Agreement commences on the earlier day of Cyber Unit providing the Services, the acceptance by Cyber Unit of a Client purchase order, or as otherwise agreed in writing and continues for the duration set out in the applicable Proposal, Quote, or SOW (Term).

6. Invoices & Payments

(a) The Client agrees to pay Cyber Unit for the provision of the Services and for the supply of any Products, as set out in a valid tax invoice issued by Cyber Unit.

(b) Cyber Unit will issue invoices as set out in an applicable Proposal, Quote, or SOW, or otherwise at the end of the month in which the Services are delivered, or in respect of Products, upon acceptance of a purchase order for the Products.

(c) The Client must pay all invoices within 30 days of the invoice date by electronic funds transfer to an account specified by Cyber Unit.

(d) All fees and prices are provided exclusive of all applicable taxes, duties, goods and services tax, and government charges (Taxes). If Taxes are payable for, or charged on, any supply made by Cyber Unit under this Agreement, the Client must pay an amount equal to the amount of Taxes charged on such supply, at the same time as the amounts due.

(e) The Client may not set-off, counterclaim, or deduct any amount from an amount owing to Cyber Unit unless it has notified Cyber Unit in writing of any disputed invoices within 5 Business Days of receipt detailing the amount and the reason for the dispute. In such circumstances, the Client must pay Cyber Unit the portion of the invoiced amounts not in dispute on the due date for payment.

7. Intellectual Property

7.1 Intellectual Property in Deliverables and provision of Services

(a) Subject to clauses 7.2 and 7.3, all intellectual property rights in the Deliverables, the Services, and any other material created by Cyber Unit in delivering the Services remain the property of Cyber Unit.

(b) Subject to clause 7.3, Cyber Unit grants the Client a non-exclusive, non-transferable, non-sub licensable, royalty-free (excluding any payments due under clause 6) licence to use in Australia the intellectual property rights in the Deliverables, the Services, and any other material created by Cyber Unit in delivering the Services for the sole and limited purpose of enjoying the benefit of the Services as set out in the Proposal, Quote, or SOW.

7.2 Background IP

Each party retains all title and ownership in its own Background IP.

7.3 Third-party intellectual property

(a) In providing the Services, Cyber Unit may provide the Client with software, Services, or Deliverables that are, or include, software, services, or other material which is owned by or is proprietary to a third party (Third Party Material). The Client agrees that:

(i) the Third-Party Material is supplied 'as is';

(ii) its use or acceptance of any Third-Party Material is conditional on the Client's acceptance of the third-party licensor's licence agreement or terms of use (Third Party Licence); and

(iii) title in any Third-Party Material remains at all times with the third party unless provided otherwise in a Third-Party Licence.

8. Confidentiality

(a) Each party agrees that where it, its Personnel, or its Related Bodies Corporate, are the recipient of Confidential Information (Recipient) of the other party (Disclosing Party), the Recipient must:

(i) treat all Confidential Information as confidential and not use it except as reasonably necessary for the purposes of this Agreement.

(ii) hold the Confidential Information in strict confidence and not disclose it to any third party (subject to any legal requirement on the Recipient to disclose the Confidential Information), except to a member of that party's Personnel who needs such Confidential Information to perform their duties and provided that such member has a legal or contractual obligation to maintain the confidentiality of such Confidential Information.

(iii) immediately notify the Disclosing Party in writing if the Recipient suspects that any Confidential Information may have been accessed by any unauthorized party.

(iv) use, at a minimum, the same degree of care with respect to its obligations under this Agreement as it employs with respect to its own confidential or proprietary information, but in no event less than reasonable care; and

(v) upon request by the Disclosing Party or termination of this Agreement, promptly deliver to the Disclosing Party any Confidential Information in its custody, control, or possession.

(b) Nothing in this Agreement requires a party to return or destroy any information contained in systems, archives, or backups that cannot be practicably deleted, which must be retained as required by Law, any accounting standard, or the rules of any stock exchange or for sound corporate governance purposes.

(c) Unless otherwise agreed in writing by the Disclosing Party, the obligations of confidentiality in clause 8(a)(i) do not apply to the extent the Confidential Information:

(i) has been lawfully disclosed to the Recipient by a third party free from obligations of confidentiality; or

(ii) is in the public domain (other than through a breach of this Agreement).

(d) The provisions of this clause 8 shall continue in force indefinitely following the termination of this Agreement.

9. Privacy

(a) Both parties agree to comply with the Privacy Laws in relation to the provision and use of the Services.

(b) Where the Client discloses Personal Information (Client Personal Information) to Cyber Unit or permits Cyber Unit to collect, access, or handle Client Personal Information under this Agreement, the Client must ensure it has obtained any authorizations from individuals necessary under all applicable Privacy Laws (Necessary Authorizations).

(c) Cyber Unit will only collect, access, use, disclose, or handle Client Personal Information to the extent necessary for the performance of the Services.

10. Data Security

(a) Cyber Unit will take reasonable precautions within its own control to prevent any Security Breach of Cyber Unit's Systems.

(b) Each party shall promptly notify the other of any Security Breach and provide reasonable assistance to the other in managing such Security Breach and/or handling any requests in relation to Personal Information.

11. Warranties

(a) Each party warrants:

(i) it has the power, capacity, and authority to enter into and observe its obligations under this Agreement; and

(ii) this Agreement has been duly executed by that Party and is a legal and binding agreement, enforceable against it in accordance with the terms of this Agreement.

(b) Except as set out in a contract, to the extent permitted by law, Cyber Unit makes no warranty or representation, express or implied, in relation to the Services, Products, or any third-party hardware or software. In relation to third-party hardware or software, Cyber Unit will ensure the Client enjoys the benefit of, and the Client agrees to comply with, the relevant third party's standard terms and conditions.

(c) Cyber Unit warrants that:

(i) the Services will be provided by exercising the same degree of skill, care, and diligence that would be exercised by a professional services provider of similar size in the same industry in similar circumstances; and

(ii) its Personnel are appropriately trained and experienced to provide the Services.

(d) Nothing in this Agreement excludes, restricts, or modifies any condition, guarantee, warranty, right, or remedy conferred on the parties by the Competition and Consumer Act 2010 (Cth) or any other Law that cannot be excluded, restricted, or modified by agreement.

12. Liability

(a) Subject to any applicable third-party licensor's restrictions, Cyber Unit indemnifies the Client for any direct Loss suffered by the Client arising from any third-party claim that the Client's use of the Deliverables or other materials provided to the Client by Cyber Unit in the performance of its Services under an Agreement (other than third-party hardware or software) infringes the rights, including intellectual property rights, of a third party. However, Cyber Unit will not be liable for any such Loss caused or contributed to by:

(i) any modification of the Deliverables or materials provided by Cyber Unit.

(ii) the use of the Deliverables or materials provided by Cyber Unit not in accordance with any directions given by Cyber Unit.

(iii) the Client's breach or failure to comply with any Third-Party Licence; or

(iv) the Client's (and its Personnel's) failure to take all reasonable steps to mitigate any Loss upon becoming aware of any such third-party intellectual property claims.

and is subject to:

(v) the Client (and its Personnel, where relevant) permitting Cyber Unit to manage any relevant claim or action in the name of the Client (or any relevant Personnel).

(b) Cyber Unit's total aggregate liability to the Client in respect of any and all Losses incurred by the Client (whether for breach of contract, in tort (including negligence) or otherwise) arising out of or in connection with the carrying out of the Services or supply of the Products under this Agreement is limited to the amount paid by the Client to Cyber Unit under the applicable Proposal, Quote, or SOW in the 12 months preceding the event giving rise to the Loss, to a maximum of $250,000.

(c) Cyber Unit's limit on liability in clause 12(b) does not apply to the following Losses:

(i) personal injury or death of a party or person to the extent caused by Cyber Unit.

(ii) damage to tangible property caused by Cyber Unit's negligent act or omission.

(iii) breach of clause 8 (Confidentiality) by Cyber Unit.

(iv) under the indemnity in clause 12(a); or

(v) breach of clause 9 (Privacy) by Cyber Unit, for which Cyber Unit's total aggregate liability is limited to $2,000,000.

(d) Notwithstanding anything in this Agreement, Cyber Unit shall not be liable under this Agreement for any indirect or consequential Loss that does not arise naturally (that is, according to the usual course of things) from the event giving rise to the Loss or any loss of profits, loss of production, loss of revenue, loss of business, loss of goodwill, damage to reputation, loss of opportunity, loss or corruption of data, or wasted overheads.

13. Australian Consumer Law

(a) This clause 13 applies where the Client is a Consumer.

(b) Clause 12 does not apply to any liability of Cyber Unit for failure to comply with a Consumer Guarantee.

(c) Cyber Unit's goods and services come with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, the Client is entitled:

(i) to cancel its service contract with Cyber Unit; and

(ii) to a refund for the unused portion or to compensation for its reduced value.

(d) The Client is also entitled to choose a refund or replacement for major failures with goods. If a failure with the goods or a service does not amount to a major failure, the Client is entitled to have the failure rectified in a reasonable time. If this is not done, the Client is entitled to a refund for the goods and to cancel the contract for the service and obtain a refund of any unused portion. The Client is also entitled to be compensated for any other reasonably foreseeable loss or damage from a failure in the goods or service.

14. Termination

(a) Either party may terminate the Agreement with immediate effect if the other party is:

(i) in material breach of the Agreement and such breach is incapable of remedy, or such breach is remediable but that defaulting party fails to remedy the breach within 14 days of receiving notice of the breach;

(ii) subject to an Insolvency Event; or

(iii) subject to an Event of Force Majeure that continues for a period of at least 90 days.

(b) Upon termination of this Agreement for any reason:

(i) Cyber Unit will cease providing the Services and Products; and

(ii) the Client must pay to Cyber Unit all outstanding amounts for Services actually performed or Products ordered by the Client or amounts that Cyber Unit has paid or owes to third parties that it cannot reasonably get out of paying in connection with this Agreement.

(c) Termination of this Agreement does not affect a liability, or any obligation of a party arising prior to termination nor affect

 any damages or other remedies which a party may be entitled to under this Agreement.

(d) On expiry or termination of this Agreement:

(i) Clauses 8 (Confidentiality), 8(d) (Privacy), 10 (Data Security), 11 (Warranties), 12 (Liability), 14(b) (Termination), and 15 (Non-solicitation) continue in full force and effect; and

(ii) all rights, obligations, and liabilities a party has accrued before expiry or termination continue.

15. Non-solicitation

During the Term and for a period of 12 months after completion of the Term, the Client must not offer work to, solicit or induce for employment, employ, or contract with, Cyber Unit's Personnel who are involved with the provision of the Services, without first obtaining the written consent of Cyber Unit (which may be withheld by Cyber Unit at its absolute discretion). This clause does not apply to a bona fide publicly listed job advertisement by the Client.

16. Modern Slavery

(a) Cyber Unit complies with the Modern Slavery Act 2018 (Cth), publishing an annual report on the Modern Slavery Register.

(b) As of the date of entering into this Agreement, Cyber Unit:

(i) has no knowledge of any modern slavery offense currently occurring within its organization or supply chains; and

(ii) takes reasonable commercial steps to identify the risk of and prevent modern slavery offenses.

(c) If Cyber Unit becomes aware of any modern slavery offense (or of any charges laid or orders made in relation to a modern slavery offense) within its organization or supply chain that directly or adversely impact the obligations in this Agreement, Cyber Unit will notify the Client in writing.

17. Miscellaneous

(a) If any provision of this Agreement is deemed to be unenforceable, invalid, or illegal, the interpretation is to be applied to reflect the intention of the parties as far as possible while not affecting the validity of the remainder of the Agreement.

(b) Neither party may assign its rights under this Agreement without the other party's prior written consent, provided however Cyber Unit can assign its rights under this Agreement to a Related Body Corporate if it wants for so long as it requires to do so.

(c) Unless otherwise provided for, in the event of any inconsistency between the terms of this master agreement and the terms of an applicable Proposal, Quote, or SOW, the following descending order of priority shall apply: (1) an amendment agreed in writing between Cyber Unit and the Client; (2) the terms contained in an applicable Proposal, Quote, or SOW; (3) any document annexed to or incorporated by reference into the agreement; and (4) this Agreement.

(d) The Client acknowledges and agrees that (i) some or all of the Services may be provided by Cyber Unit Pty Ltd and/or its Related Bodies Corporates, and (ii) Client data may be stored or accessed from locations outside of Australia for the purpose of Cyber Unit Personnel providing the Services from locations outside of Australia. The Client agrees that if it procures any third-party hardware or software through Cyber Unit, Cyber Unit may be required to provide the relevant third-party certain Client data to facilitate the supply of that hardware/software.

(e) All notices and consents must be sent by email to, in the case of the Client, the email address for the Client or its representative set out in a Proposal, Quote, or SoW, and in the case of Cyber Unit, the Cyber Unit representative set out in the Proposal, Quote, or SOW, with any legal notices or notice of dispute, copied to support@cyberunit.com.au.

(f) This Agreement is governed by the laws of the State of Victoria, Australia.

(g) Cyber Unit will not be liable for any delay or failure to supply the Services or Products if such a delay or failure was due to an Event of Force Majeure.

(h) Any dispute relating to the subject matter of this Agreement shall be submitted to mediation prior to any other dispute resolution process being invoked. The parties will agree on a mediator within 21 days of either party giving the other written notice of intention to invoke mediation. If the parties cannot agree on a mediator, then the dispute will be referred to the Australian Disputes Centre (ADC). All mediation proceedings will be conducted in accordance with the ADC's ADR Guidelines.

(i) No party is authorized to bind another party, and nothing in this Agreement is construed as creating a relationship of principal and agent, partners, trustee and beneficiary, or employer and employee.

(j) This Agreement may only be amended or replaced with the written agreement of all parties.

(k) This Agreement constitutes the entire agreement between the parties and supersedes any prior conduct, arrangement, representation, agreement, or understanding in relation to its subject matter.

(l) This Agreement can be signed in counterparts. If an electronic signature is used, it shall have the same effect as a handwritten signature.

18. Definitions and interpretation

18.1 Definitions

All capitalized terms have either the meanings given to that term in the Proposal, Quote or SOW, the definitions in this clause 17.1, or where otherwise set out in the Agreement:

Agreement means these general terms and conditions and, as relevant:

(a) the Proposal, Quote or SOW to which they are attached, referenced, or attached (including any agreed written variation); or

(b) any purchase order submitted and accepted in accordance with clause 1.3, each of the above creating and forming a binding Agreement.

Australian Consumer Law is as set out in schedule 2 to the Competition and Consumer Act 2010 (Cth); and the corresponding provisions of the Australian Consumer Law as applicable (and each of its equivalents in the Australian States and Territories).

Background IP means a party's intellectual property rights in any materials developed independently of, or prior to, the provision of the Services and the Deliverables and includes any third-party licensed intellectual property;

Business Day means a day that is not a Saturday, Sunday, public holiday or bank holiday in the location where the Services are being provided (unless expressed otherwise in a Proposal, Quote or SOW);

Client means the customer who has requested the Services to be performed by Cyber Unit.

Client Data means the data owned or supplied by the Client which is accessed by Cyber Unit (including its Related Bodies Corporate) or its subcontractors in the course of performing the Services.

Confidential Information means any and all information (in any form or media) of a confidential nature that is made available directly or indirectly, and before, on or after the date of this Agreement including financial, client, employee and supplier information, product specifications, policies and procedures, processes, statements, formulae, trade secrets, Client Data, drawings and data which is not in the public domain (except by virtue of a breach of the confidentiality obligations arising under this Agreement);

Consumer has the same meaning as in section 3 of the Australian Consumer Law.

Consumer Guarantee means a Consumer guarantee applicable to this Agreement under the Australian Consumer Law.

Cyberattack means any breach of (or attempted or threatened breach of) or unauthorized access to the Client's Systems, including identity or intellectual property theft, exploitation of ICT systems, phishing, spamming, denial-of-service (including distributed), stolen hardware, or website defacement.

Cyber Unit means Cyber Unit Pty Ltd and any of its Related Bodies Corporate.

Deliverables means the materials, reports, and other deliverables to be provided by Cyber Unit as set out in the relevant Proposal, Quote, or SOW.

Digital Forensic Services includes:

(a) digital forensic investigation.

(b) digital forensic analysis.

(c) forensic reporting and opinions.

(d) threat hunting.

(e) cyber threat intelligence and risks assessment; and

(f) any other activities carried out for, or on behalf of, the Client under a Proposal, Quote, or SOW.

Education Services means education delivered by Cyber Unit, that may include computer-based training, instructor-led training (online or in person), assessment tools, phishing programs, workshops, and simulations, or as otherwise made available.

Education Voucher is a voucher purchased by the Client for Education Services that can be redeemed (including against presenter's travel time) no later than 12 months from the date of issue.

Event of Force Majeure means any event or circumstance, or a combination of events or circumstances, which is beyond the reasonable control of an affected party (but does not excuse any obligation to make payment).

Insolvency Event means:

(a) bankruptcy proceedings are commenced against the relevant party, or the relevant party is declared bankrupt.

(b) any step is taken to appoint a receiver, a receiver and manager, a trustee in bankruptcy, a liquidator, a provisional liquidator, an administrator, or other like person to the relevant party or to the whole or any part of the relevant party's assets or business.

(c) if the relevant party is in a partnership, the partnership is dissolved, or an application is made to dissolve the partnership;

(d) the relevant party is or becomes unable to pay its debts as they fall due or is presumed pursuant to section 95A of the Corporations Act 2001 (Cth) to be unable to pay its debts as they fall due; or

(e) a relevant party has something having substantially similar effect to any of the events specified above occur in any jurisdiction under or in respect of any law;

Laws means all laws including rules of common law, statutes, regulations, subordinate legislation, proclamations, ordinances, by-laws, rules, regulatory principles and requirements, mandatory codes of conduct, writs, orders, injunctions, judgments, and any awards, which are applicable from time to time in the jurisdiction in which Cyber Unit or its Personnel perform their obligations under this Agreement.

Loss means any loss, cost, liability or damage, including reasonable legal costs on a solicitor/client basis.

Personal Information has the meaning given to that term in the Privacy Act.

Personnel means, in relation to a party, its employees, Related Bodies Corporate, secondees, officers, agents, advisers, and contractors.

Privacy Act means the Privacy Act 1988 (Cth);

Privacy Laws means the Privacy Act and all other applicable privacy and data protection Laws as may be in force from time to time which regulate the collection, use, disclosure, storage of and granting of access rights to Personal Information.

Privacy Policy means the documented policy of Cyber Unit, as amended from time to time, located at: https://www.cyberunit.com.au/about/privacy-policy.

Product means any products or goods supplied pursuant to the Agreement.

Proposal means a proposal prepared by Cyber Unit for Services to be provided to the Client by Cyber Unit that references or incorporates these general terms and conditions.

Quote means a quote prepared by Cyber Unit for Services to be provided to the Client by Cyber Unit that references or incorporates these general terms and conditions.

Related Body Corporate is as defined in the Corporations Act 2001 (Cth) and equivalent to a 'related company' as set out in the Companies Act 1993 (NZ);

Security Breach means any unauthorized access to, or alteration of data that a party is responsible for or in control of.

Security Testing Services means penetration testing, red teaming, intrusion techniques, code reviews, security threats and risks assessment, and any other security testing or assessment activities carried out for a Client under a Proposal, Quote, or SOW.

Services means the services to be provided to the Client by Cyber Unit, as set out in a relevant Proposal, quote, or SOW.

Staff Augmentation means the use of Cyber Unit Personnel to fill or augment the capacity and capability within the Client's business.

Statement of Work or SOW means a statement of work setting out the Services and/or products to be provided to the Client by Cyber Unit and which has been signed by both Cyber Unit and the Client.

Systems include networks, software, applications, computers, servers, mobile devices, cloud services (including storage, software, platforms, and infrastructure as a service), industrial control systems, and any other IT systems or equipment.

Term has the meaning given to that term in clause 5.

Third Party Licence has the meaning given to that term in clause 7.3(a)(i).

Third Party Material has the meaning given to that term in clause 7.3(a); and

Travel Voucher is a voucher purchased by the Client for travel expenses to the nominated Client location for delivery of instructor-led training to be used no later than 12 months from the date of issue.

18.2 Interpretation

In this Agreement, unless the context requires otherwise:

(a) clause and subclause headings are for reference purposes only.

(b) the singular includes the plural and vice versa.

(c) words denoting any gender include all genders.

(d) a reference to a person includes any other entity recognized by law and vice versa.

(e) where a word or phrase is defined, its other grammatical forms have a corresponding meaning.

(f) any reference to a party to this Agreement includes its successors and permitted assigns.

(g) any reference to any agreement or document includes that agreement or document as amended at any time.

(h) the use of the word includes or including is not to be taken as limiting the meaning of the words preceding it.

(i) the expression at any time includes reference to past, present, and future time and performing any action from time to time.

(j) no provision of this Agreement will be construed adversely to a party because that party was responsible for the preparation of this agreement or that provision.

(k) a reference to any legislation includes all delegated legislation made under it and amendments, consolidations, replacements, or re-enactments of any of them; and

(l) an agreement, representation, or warranty by two or more persons binds them jointly and severally and is for the benefit of them jointly and severally.

Schedule 1: SECURITY TESTING TERMS

1. Application of these Terms

(a) These Security Testing Terms apply if security testing and assurance services are provided by Cyber Unit.

(b) The Client warrants that it is aware of the nature of the Security Testing Services, in particular that the Security Testing Services may include:

(i) simulating or performing controlled Cyberattacks on the Client's Systems.

(ii) deliberate attempts to penetrate the security of the Client which may be provided by a third party.

(iii) red teaming (including, but not limited to, deliberately masquerading as a hostile attacker with the intention of detecting vulnerabilities) activities in relation to the Client and its premises and Systems; or

(iv) deliberately allowing unauthorized access to the Client's network or Systems for the purpose of analysing threat vectors and origination.

2. Acknowledgment and liability

(a) The Client accepts that the Security Testing Services:

(i) are sample testing activities only and cannot account for all possible ways a third party could breach the Client's security measures or Systems.

(ii) do not implement any security measures and will not prevent security or data breaches, or Cyberattacks.

(iii) could result in interruptions or degradations to the Client's Systems and accepts those risks and consequences; and

(iv) although carried out by professional Cyber Unit Personnel and tools from trusted resources, carry an element of risk that can never be fully eliminated, and the Client accepts that there is no guarantee that every vulnerability in its Systems will be identified during the Security Testing Services.

(b) In carrying out the Security Testing Services, the Client acknowledges and agrees that Cyber Unit:

(i) as agent of the Client, is considered to be party to a communication in the case of intercepting any private communication on the Client's Systems.

(ii) is expressly authorized by the Client to perform such Services (and all tests reasonably necessary to perform the Services) on the relevant network resources and IP addresses. The Client represents that, if it does not own such network resources, it has requisite consent and authority to engage Cyber Unit to provide the Security Testing Services.

(iii) provides no warranty or guarantee as to the outcome of the Security Testing Services, all testing has limitations, and that such testing cannot guarantee discovery of all weaknesses, noncompliance issues, or vulnerabilities; and

(iv) may use various proprietary methods and software tools to probe network resources, and to detect actual or potential security flaws and vulnerability, which will not be revealed by Cyber Unit.

(c) No other terms or any other agreement will limit the Client's authorization or liability in clause 2(b)(a) of this Schedule.

Schedule 2: DIGITAL FORENSIC TERMS

1. Application of these Terms

(a) These Digital Forensic Services Terms apply if digital forensic services are provided by Cyber Unit.

(b) The Client warrants that it is aware of the nature of the Digital Forensic Services and that should Cyber Unit form a reasonable belief or identify evidence of serious criminal conduct during an engagement, Cyber Unit may be required to notify law enforcement.

2. Acknowledgment and liability

(a) The Client acknowledges and agrees that the Digital Forensic Services:

(i) may involve access or storage of Client data from locations in Australia or overseas, by Cyber Unit employees, subcontractors, or vendors. Your authority to proceed or engage is dependent on acceptance of this access and storage.

(ii) are intended only for the Client only and outputs may not be provided to any third party without Cyber Unit's prior written consent.

(iii) are not intended to provide any specific results, other than to identify factual findings, analysis of evidence, and responses to specific questions related to the provision of our expert opinion.

(iv) are not legal advice or legal opinions and no output constitutes legal advice.

(v) are provided 'as-is'; and

(vi) are not delivered against any standards or guidelines unless otherwise agreed in writing.

(b) In carrying out Digital Forensic Services, the Client agrees that Cyber Unit:

(i) is expressly authorized by the Client to perform such Services (and all such tasks and tests reasonably contemplated by or reasonably necessary to perform the Services) and the Client does so in compliance with all relevant Laws (including the Privacy Act);

(ii) Once engaged, is authorized to accrue costs or liability, and the client accepts and will meet all costs or liability until the conclusion of the engagement, or the Client instructs in writing that the Services be suspended or terminated;

(iii) is acting on behalf of the Client, so in the case of intercepting any private communication on the Client's Systems, Cyber Unit as agent of the Client is considered to be a party to such private communication.

(iv) provides no warranty or guarantee as to the outcome of the Digital Forensic Services, or any resulting legal or other proceedings.

(v) will rely on the information provided by the Client as true and correct, and that unless otherwise agreed, will not undertake any review, validation, or audit to ascertain the completeness or accuracy of information provided; and

(vi) leverages cyber threat intelligence gained through previous engagements for other clients. Through the course of our work, Cyber Unit may collect cyber threat intelligence, including from the Client Systems, focused on attacker tools and methods. Any external use of such cyber threat intelligence will not include information that may identify the Client organization, networks, Systems, sensitive information, staff, customers, related parties, or include any Client confidential information.

(c) No other terms or any other agreement will limit the Client's authorization or liability in clause 2(b) of this Schedule.

Schedule 3: EDUCATION SERVICES

1. Application of these terms

(a) These Education Services terms will apply if education services are provided by Cyber Unit.

2. Ordering & delivery

(a) Where the Client orders Education or books Education Services under an Education Voucher, the Client must nominate the number of attendees, the delivery location, and a delivery date at least 4 weeks in advance of the order.

(b) If the Education Voucher or Travel Voucher purchased by a client is not sufficient for the proposed Education Services, the Client must purchase vouchers or provide additional payment to meet the applicable amount.

3. Changes to bookings

(a) A Client may request changes to a confirmed delivery date once, up to 8 weeks before delivery.

(b) Any cancellation request less than 8 weeks before delivery is not refundable.

4. Delivery of Education Services

(a) A Proposal, Quote or SOW will specify the Services, the delivery approach (in person, online, or computer-based), required travel, and presentation days.

(b) Attendees must be confirmed 1 week before the delivery date.

5. Vouchers

(a) The Client may pre-order an Education Voucher of A$10,000 ex GST and/or a Travel Voucher of A$1500 ex GST.

(b) Education and Travel Vouchers are valid for 12 months and nonrefundable in whole or any unused part.

(c) Education Vouchers can be redeemed against any Education Service as applicable or agreed.

(d) A Travel Voucher represents the ground and air travel, accommodation, and expenses associated with 1 day of travel within Australia.

(e) Presenters will travel to the delivery location the day before the first day of delivery.

(f) Subject to flight availability if the return trip is:

(i) under 3 hours the presenter will return the same day.

(ii) over 3 hours the presenter will return the following day.

(g) International travel may be redeemed, following scoping and agreement between the parties.

Schedule 4: STAFF AUGMENTATION TERMS

6. Application of these terms

(a) These terms apply if staff augmentation services are provided by Cyber Unit.

(b) The Client warrants that it is aware of the nature of Staff Augmentation Services. In this Schedule, Staff Augmentation Services are provided on the basis that Cyber Unit Personnel will be working under the direction and control of the Client, and the Client remains responsible for all (project and/or work) outcomes.

7. Acknowledgement and Liability

(a) The Client acknowledges and agrees that:

(iii) Cyber Unit Personnel may be engaged either at the Client premises or remotely.

(iv) the Client is responsible for all work output, decisions, directions, or omissions of the Cyber Unit Personnel providing Staff Augmentation Services.

(v) the Client is responsible for all project outcomes from the Staff Augmentation Services.

(vi) Cyber Unit warrants that its Personnel have the knowledge, skill, and experience to perform the agreed role or tasks; and

(vii) the only Deliverable is the provision of Cyber Unit Personnel to perform the agreed tasks or role.

(b) All outputs, including any intellectual property rights in those outputs, from Staff Augmentation Services will be owned by the Client upon full payment of the relevant invoice(s).

(c) Cyber Unit is responsible for the remuneration, including salary, superannuation, or associated taxes of Cyber Unit Personnel.