BizTech Law Blog Banner

BizTech Law Blog

Considerations for Vendor Contracts

This is the first article in a series on Third Party and Vendor Management. The next article in this series discusses provisions for vendor contracts.

As the number of vendors that businesses engage with rises, so does the need for a greater contractual understanding of vendor agreements among businesses, CIOs, IT departments, and general counsels alike. While many of the underlying contractual principals remain the same, overlooking the differences can be costly. Considerations for vendor contracts:

  • Security/Privacy – a vendor’s most reliable assurances are often viewing a vendor’s certifications and audit results. It may be impractical to impose a customer’s security standards and policies on a vendor when the vendor uses a multi-tenant model and cannot customize the security across multiple users.
    • Important questions: Who is responsible for different layers of security? What level of security applies? How will the vendor use the data? How will the data be transmitted?
  • Limitation of Liability – vendors will often look to limit liability to a multiple of trailing revenues over a fixed time period when the service offered is subscription-based that can be utilized for many years and lead to disproportionate results. Special indemnities are rare, but third-party infringement indemnity is standard.
  • Access to Data – defining a recovery point for the total amount of data that can be lost based on a back-up policy is important. Special arrangements may have to be made to access/recover data after expiration of the contract for portability purposes. This may require obtaining transition services from the vendor.
    • Important questions: What happens when the relationship ends? What if data needs to be deleted? Will subcontractors have access to the data? How long does the data need to be retained?
  • Privacy – largely governed by statutes and regulations, but considerations should include response plan and notification provisions in the event of a breach with emphasis on the specificity of terms and conditions for various types of data.
    • Important questions: Where is data stored and processed? Are data transfer mechanisms in place?
  • Service Levels – ensure familiarity with requirements and expectations of the vendors because generally these characteristics are not negotiated. However, remedies for breach can include service level credits or the right to terminate the contract.
    • Important questions: How much downtime is expected? What are the remedies?
  • Subcontractors – guarantee that the vendor passes on its obligations to its subcontractors and monitors their compliance with regard to data privacy, breach notification, security controls, and regulatory standards.

Often successful vendor management turns on the ability of the parties to establish clear expectations upfront. For further guidance on vendor management and cybersecurity issues in general, please contact a Foster Swift Business & Corporate attorney.

Authors

Categories

Recent Posts

Jump to Page

Foster Swift Collins & Smith PC Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek