Cyber security
Cyber Security Contract Review
Fixed-fee review of security, breach and liability terms in your customer and supplier contracts.
Know what you need? Request a fixed-fee quote and upload your documents. Not sure of scope? Book a short call with a senior lawyer instead.
In short
We review the cyber and data security terms in your customer and supplier contracts so you do not promise more than you can deliver, and so the risk of a breach is shared sensibly. Fixed fee, contracts only.
Large customers send security schedules, questionnaires and uncapped breach indemnities. Signing without review can commit you to controls you do not have.
What we review
- Security schedules and technical commitments
- Certification and framework warranties such as ISO 27001, SOC 2 and ASD Essential Eight maturity
- Breach notification timing and cooperation duties
- Audit and inspection rights
- Subcontractor and sub-processor controls
- Liability caps and indemnities for data and security events, aligned to your cyber insurance. See what is liability and insurance clauses.
- Return and deletion of data on termination
- Vendor security questionnaires and tender responses
Who this is for
- SaaS and software companies selling to enterprise
- MSPs and IT providers managing client systems
- Suppliers to government and regulated entities, including CPS 230 flow-downs
- Businesses engaging cloud, AI or outsourced IT vendors
What you receive
- A marked-up contract with plain-English notes
- A list of commitments you should not accept as drafted
- Suggested replacement wording ready to send
We review contracts and legal obligations. We do not test systems; where you need technical assessment we can draft the engagement terms with your security specialist.
Related: privacy and data protection, breach response plans, data processing agreements.
Frequently asked questions
What does a cyber security contract review cover?
We review the security, data and liability clauses in customer, supplier and partner contracts: security schedules, audit rights, breach notification timing, subcontractor controls, insurance requirements, and who bears the loss if something goes wrong.
A customer sent us a security questionnaire and schedule. Can you help?
Yes. We check that what you are promising is accurate and achievable, flag commitments such as ISO 27001, SOC 2 or Essential Eight maturity warranties that could expose you if you fall short, and propose wording you can negotiate.
How should liability for a data breach be allocated in a contract?
Commonly through a separate, higher cap or super-cap for data and security breaches, aligned to your cyber insurance. We advise on realistic figures and structure so that you do not accept uncapped exposure.
Do you assess our technical security?
No. We review contracts and legal obligations. For technical testing or certification you will need a security specialist, and we can draft the engagement terms with them.
Is this a fixed fee?
Yes. We scope the documents and the issues first, then agree a fixed fee before work starts.
Two ways to start
Get a fixed fee before any work starts.
Answer a few short questions, attach your documents if you have them, and a senior lawyer replies with the scope and the price.
Know what you need? Request a fixed-fee quote and upload your documents. Not sure of scope? Book a short call with a senior lawyer instead.