The engagement is ready to go. Scope is agreed, the fee is agreed, and the team is lined up to start Monday. Then the client’s legal department sends the contract back with redlines.
Notify us within 24 hours of any security incident. Uncapped liability for a data breach. We can audit your controls once a year. Carry $5 million in cyber coverage and name us on the policy.
The redlines go to your legal team, and there they sit. Your people are on the bench waiting. The client’s point of contact still has a deadline, and it gets shorter every week. Eventually somebody calls legal and asks what it will take to get this signed.
The Lead
This is a multi-party negotiation, and each party is watching a different number.
The point of contact cares about price. So does procurement. They have a budget, a project deadline, and a boss asking why this costs what it costs. Legal is focused on something else. Their job is to protect the company if something goes wrong, so they’re reading the liability cap, the indemnity, and the security terms. The fee on page one isn’t their problem.
The data shows the split. In WorldCC’s 2020 Most Negotiated Terms report, legal counsel ranked limitation of liability as the term they negotiate most. Non-legal respondents ranked price first. Same contracts, two groups, two different top priorities.
From WorldCC’s 2024 Most Negotiated Terms report: limitation of liability, price, and indemnification remain the most negotiated contract terms, and the list has stayed consistent over time.
So the deal gets negotiated twice. Your engagement lead spends weeks with the point of contact landing scope and price. Then the contract goes to legal, where a different person with a different job starts over on terms. That person doesn’t know what your firm already gave up on price to win the work, and has no reason to care. By the time the redlines show up, the client’s point of contact is on your side and ready to start. Their lawyer is having a different conversation.
Cyber terms sit entirely at the legal table. In WorldCC’s 2022 survey, 57% of respondents said they negotiate cybersecurity and data protection terms often or all of the time, and legal typically holds the authority over those clauses.
Any one of those redlines looks reasonable on its own. Then look at what each one asks the firm to do.
24-hour notice. Your forensics firm may need days to tell you what happened. You’ve promised an answer before you have one.
Uncapped breach liability. One client’s data incident can reach past the fees on that engagement and into the firm’s balance sheet.
IP ownership. The client wants to own everything created on the engagement. That can include the templates, tools, and methods your team brought in and uses on every other client.
Returning or destroying client data. At the end of the engagement, you certify that every copy of their data is gone. That means laptops, email, file shares, and backups, so you need to know where all of it went before you sign.
Coverage requirements. You’ve promised a policy limit. Whether your policy actually says that is a separate question.
Client-specific controls. One client wants files encrypted a certain way, another wants a particular framework, and your IT team ends up running several security programs.
Now multiply by your client list. Forty clients can mean forty notification windows and forty liability caps, each agreed while a team sat on the bench and a deadline got closer. Last year I wrote about how small concessions add up to lost margin. Cyber terms add up the same way, except the bill shows up during an incident.
That total is a board number. Together, those promises decide what a breach will cost the firm, and right now they sit in a filing cabinet as separate contracts.
Quick tip: Bring the terms in while you’re still working on scope. When the proposal goes out, include your standard terms and say, “Here are our standard terms, so we can move the process along.” That gets legal started early and gets the client bought in before the work is on the line. If they’d rather wait until price and scope are settled, that’s fine, because by the time terms come up they’ve already decided they want to work with you. Either way, legal and the point of contact end up in the same negotiation while price is still in play.
The Close
One question for the next board meeting:
What have we promised our clients about cyber, added up across every contract, and who approved it?
Next: the same contract from the client’s chair, in The Buyer Side.
