Discuss Your DRA Project
Not Sure? Find Your Option
Legal

DRA Services Terms

Corgenta performing a Detailed Risk Assessment for you · Version 1.0 · Last updated 6 Nov 2026

1. About these terms

These terms apply when a business engages Corgenta Ltd (company number 04788104, registered office 1110 Elliott Court Business Park, Herald Ave, Coventry CV5 6UB, UK) to carry out a Detailed Risk Assessment (DRA). They are for business customers only, not consumers.

The contract is made up of a signed statement of work (SOW) and these terms. If they conflict, the SOW wins.

These terms work alongside our Privacy Notice. Section 12 sets out how we process personal data on your behalf.

2. The service

  • Corgenta’s engineers carry out a Detailed Risk Assessment (DRA) aligned with IEC 62443-3-2 for each System Under Consideration (SUC) named in the SOW.
  • We work on the Corgenta DRA platform, in a tenant set up only for you. Your data is never mixed with another client’s.
  • We deliver remotely. If the SOW includes site visits, we charge them at the day rate set in your proposal and confirmed in the SOW, plus expenses under section 3.

3. Expenses

  • We charge expenses only for site visits and other travel that the SOW includes or that you approve in writing.
  • We charge expenses at cost, with no mark-up, and send receipts with the invoice.
  • Travel: standard-class rail, economy-class flights, and car mileage at the HMRC approved mileage rate.
  • Accommodation and meals: at reasonable business rates for the location.
  • Any other expense needs your written approval before we incur it.
  • Travel time is charged as set out in your proposal.
  • We invoice expenses monthly in arrears. They are payable under section 8.

4. Scoping, quote and price

  • We agree the scope with you through a scoping call and a scoping questionnaire.
  • We then quote a fixed price per SUC. Prices start from £7,500 per system and exclude VAT.
  • A quote is valid for 30 days from the date we issue it.
  • Any discount appears only in the SOW.

5. Deliverables

  • Included in the base price: the DRA report (PDF), the risk register and the structured export of your results.
  • Optional extras, priced in the SOW: evidence-gap schedule, risk treatment plan, assessor-of-record sign-off, accelerated delivery and additional systems.

6. Your responsibilities

  • Give us the information, documents and access to people that the SOW lists, on time.
  • Name an approver with authority to review and approve the DRA.
  • Check the information you give us is accurate. Our findings depend on it.
  • If you are late with inputs, reviews or approvals, this may affect the price and the schedule. We will tell you in writing of any change to the price or dates before it applies.

7. Approval and risk ownership

  • Your named approver reviews and approves the finished DRA on the platform.
  • Corgenta assesses and recommends. You decide, and your named approver accepts the residual risk.
  • Corgenta signs as assessor of record only if you buy that option in the SOW.

8. Payment

  • We invoice 50% of the price when you sign the SOW and send us your purchase order.
  • We invoice the other 50% after your approver approves the finished DRA. This must be paid before we release the deliverables.
  • Invoices are payable within 7 days of the invoice date.
  • We hold the PDF DRA report and the structured export until the final payment is made.
  • All prices exclude VAT. Where VAT applies, we add it to the invoice.
  • If you pay late, we may claim under the Late Payment of Commercial Debts (Interest) Act 1998: interest at 8% a year above the Bank of England base rate, a fixed sum of £40, £70 or £100 depending on the size of the debt, and reasonable recovery costs.

9. Kick-off, changes and cancellation

  • Kick-off is the kick-off meeting. We hold it after we receive your purchase order and the first payment.
  • Any change to scope needs a signed SOW variation with its price.
  • The first payment is not refundable once paid, whether you cancel before or after kick-off.

10. Access after delivery

  • You get read-only access to the platform for 3 months from delivery, to view and approve the DRA.
  • We remind you to export your results before access ends.
  • We delete your tenant data 30 days after access ends, unless you buy a DRA Project or DRA Professional licence, which keeps it.

11. Your data and confidentiality

  • Your data is hosted by Hetzner in Finland, in your own tenant.
  • Where we process personal data on your behalf, section 12 applies.
  • Each of us keeps the other’s confidential information confidential and uses it only for this engagement.

12. Data processing

This section applies when we process personal data on your behalf while we carry out the service. You are the controller and Corgenta is the processor under UK GDPR. It forms part of each SOW; there is no separate annex.

  • Subject matter and duration: carrying out the DRA under each SOW, then your read-only access period and the 30 days after it ends (section 10).
  • Nature and purpose: collecting, hosting, analysing and storing the information you give us so we can carry out, review and release the DRA.
  • Personal data: names, work contact details and roles of your contacts, approver and platform users, platform activity records, and any personal data in the documents and information you give us.
  • Data subjects: your staff and contractors who work with us or use the platform, and people named in the information you give us.
  • You are responsible for having a lawful basis for the personal data you give us, and for the instructions you give us.
  • We act only on your documented instructions, including these terms and the SOW, unless the law requires otherwise. We tell you if we think an instruction breaks data protection law.
  • Everyone we allow to process the data is bound by confidentiality.
  • We apply appropriate technical and organisational security measures (UK GDPR Article 32).
  • Sub-processors: Hetzner (hosting, Finland) and Microsoft 365 (email and documents). You authorise these. We tell you before adding or replacing a sub-processor so you can object, and we bind each one to equivalent data protection terms.
  • We help you respond to requests from data subjects and meet your duties on security, breach notification, impact assessments and consultation with the ICO.
  • We tell you without undue delay after becoming aware of a personal data breach affecting your data.
  • We delete the data, including copies held outside the platform, 30 days after your access ends (section 10), unless you buy a licence that keeps it or the law requires us to keep it.
  • We give you the information needed to show compliance with this section, and allow audits and inspections by you or an auditor you appoint, with reasonable notice.
  • We transfer the data outside the UK only with appropriate safeguards (see Privacy Notice, section 6).

13. Intellectual property

  • Once you have paid in full, you own the content of the deliverables and may use them for your own business.
  • Corgenta keeps ownership of the platform, our methods, templates and know-how.

14. No certification or compliance guarantee

The DRA is aligned with IEC 62443-3-2. It does not certify any system and does not guarantee compliance with IEC 62443 or any other standard or law.

15. Quality and corrections

We carry out the service with reasonable skill and care. If you tell us about an error in a deliverable within 1 week of delivery, we correct it at no extra cost. This does not cover changes to scope or to the information you gave us.

16. Liability

Our total liability under each SOW is limited to the fee paid under that SOW. We are not liable for indirect or consequential loss, or for loss of profit, revenue or data. Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.

17. General

  • These terms and the SOW are the whole agreement between us about the service.
  • Neither of us may transfer the contract without the other’s written consent.
  • Notices go to legal@corgenta.com and to the contact named in the SOW.
  • These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule: what each SOW states

  • Customer legal entity, contacts, purchase order number and the named approver.
  • Each system under consideration and its scope boundary.
  • Fixed price per SUC, extras chosen, and any discount.
  • Inputs and access you will provide, with dates.
  • Delivery plan, kick-off meeting date and target delivery date.
  • Site visits and the day rate from your proposal, if any.
  • Payment schedule: 50% on signing and purchase order, 50% on approval, before release; payable within 7 days.