Cybersecurity vendors

Holding the incident notice and breach liability positions.

Your customers buy security, so their counsel negotiates security terms harder than anyone else's. Incident notice measured in hours, breach liability outside the cap, audit rights on short notice, and a security schedule that reads as a warranty. Leela reviews each customer draft to your positions, keeps the security schedule and the main agreement consistent with each other, and records what was agreed with each customer, so your incident notice commitments across the book are known rather than scattered.

Leela Received. I am reviewing the MSA and the security schedule together against the playbook. 10:13 AM

Reviewed against the playbook: 12 issues, the three security positions treated as one set

Dear Asha

There are 12 issues. The three you named are connected and I have treated them as one set.

Incident notice at Schedule 3, paragraph 4 is 12 hours from discovery in Vantage's markup, against the playbook standard of 72 and fallback of 48. Breach liability at MSA 13.4 is carved out of the cap entirely; the playbook permits a super-cap of 3 times fees for data incidents and nothing beyond it. Audit rights at 14.2 permit audits at any time on 5 business days notice; the standard is annual on 30 days, with a right for Vantage to rely on your SOC report in between. I have redlined each to the standard and noted in the margin that the three are offered together: 48-hour notice, the 3 times super-cap and annual audit with the report, which is the fallback set. The markup also redefines Security Incident at paragraph 1 to include unsuccessful attempts, which would make the notice obligation unworkable; I have restored the confirmed-compromise definition.

The remaining issues are drafting and within the fallback, except the source code escrow at 18.1, which is open for you.

Leela

W Vantage MSA - issues list.docx70 KBW Vantage MSA - redline.docx262 KBW Vantage security schedule - redline.docx124 KB

Incident notice

Hours from discovery, what counts as an incident, and what the notice has to contain. Each held to the standard and the fallback, and the commitment made to each customer recorded so the book can be answered.

Breach liability

Inside the cap, under a super-cap, or uncapped. The position that trades against notice and audit, and is negotiated as part of that set rather than on its own.

Audit rights and the SOC report

Frequency, notice, scope and the right to rely on the report between audits, consistent between the schedule and the main agreement.

Tell us about your contracting workflow.

Request access