A Guide to IT Contracting

Checklists, Tools, and Techniques

Michael R. Overly

• Publisher: Auerbach Publications
• Year: 2021
• Print ISBN: 9780367489021
• eBook ISBN: 9781000381023
• Edition: 2
• Topic: Business
• Subtopic: IT Industry
• Index: Business

Since A Guide to IT Contracting: Checklists, Tools, and Techniques first published, several alarming trends have developed in the technology contracting industry. These trends include:

• 
  
  

• The Dawn of the "As-Is" Technology Product

• 
  
  

• The Ever-Changing Product

• 
  
  

• Where in the World Is My Data?

To meet these challenges, the Second Edition helps business managers and lawyers explore alternate solutions from other vendors, conduct simultaneous negotiations with other vendors, and, generally, ensure prospective vendors understand they can "lose the deal" if they refuse to act reasonably.

Distilling the most critical business and legal lessons learned through the author's decades of legal experience drafting and negotiating IT-related agreements, this single volume lets readers quickly access information on virtually every type of technology agreement. Structured to focus on a particular type of IT agreement, each chapter includes a checklist of essential terms, a brief summary of what the agreement is intended to do, and a complete review of the legal and business issues that are addressed in that particular agreement. Providing nonlegal professionals with the tools to address IT contracting issues, the book:

• 
  
  

• Contains checklists to help readers organize key concepts for ready reference

• 
  
  

• Supplies references to helpful online resources and aids for contract drafting

• 
  
  

• Includes a complete glossary that defines key legal, business, and technical terms

Technology contracting is becoming ever more difficult. This book is filled with recommendations to mitigate potential risk and makes clear the importance of maintaining negotiating leverage with potential vendors.

Chapter 1

Collecting Basic Deal Information

CHECKLIST

Basic Principles

• □ Marshal basic information
• □ Value of proposed transaction?
• □ Term of agreement?
• □ Criticality of technology to business?
• □ Unique regulatory issues?
• □ Other foundational information?
• □ Circulate a “deal memo”
• □ Circulate a “term sheet”

Describe the Engagement

• □ What is the deal about?
• □ Business advantage from contract?
• □ Use nontechnical English

Useful Life

• □ Anticipated duration of contract
• □ Desired renewal terms
• □ Duration of services rendered
• □ License for years or perpetual?
• □ Renewal rights
• □ Costs for renewal

Expected Fees

• □ Compensation to vendor
• □ Breakdown of first-year fees
  • – License
  • – Professional services
  • – Implementation
  • – Customization
  • – Hardware
  • – Telecommunication
• □ If no fees, good faith estimate
• □ When to use customer’s form

Performance

• □ Customer-facing application?
• □ Location for service performance?
• □ Offshore vendor?
• □ Vendor uses offshore partners/affiliates?
• □ Vendor uses subcontractors? If so, who?
• □ Location for vendor performance?
• □ Vendor provides hosting services?

Intellectual Property

• □ Will the customer want to own vendor-created IP?
• □ Vendor cannot share with competitors?
• □ Vendor cannot share with industry?
• □ Vendor has access to sensitive IP?

Personal Information

• □ Vendor access to personally identifiable information?
• □ What information is at risk?
• □ Financial account information?
• □ Health information?
• □ Social Security Numbers?
• □ Legal and regulatory requirements
• □ Transmission across international borders

Information Security

• □ Vendor access to sensitive customer data?
• □ Cloud computing–based service?
• □ Hosting service?
• □ Is vendor sole custodian of customer data?

Unique Issues

• □ Vendor’s financial situation is suspect
• □ Vendor is subject of litigation
• □ Vendor had recent security breach
• □ Performance constraints
• □ Substantial regulatory/compliance issues

Overview

Before any proposed technology contract can be reviewed, certain basic information about the deal must be marshaled. This includes the value of the proposed transaction, the term of the agreement, the criticality of the technology to the business, how long to implement, unique regulatory issues (e.g., is sensitive personally identifiable data at risk?), and other foundational information. While this process may seem self-evident, it is common for businesses to rush forward in the review of a proposed technology contract without this critical information.

In our experience, moving forward without a clear understanding of the “deal” can result in misunderstandings with the vendor, failure to achieve an adequate and appropriate contract, delays in negotiations, and increased costs. For example, it would likely not be appropriate to require the same level of contractual protection in a $20,000 off-the-shelf license agreement as one would require in a $20 million custom software development deal for a critical client-facing application. Similarly, it would probably not be fruitful to propose extensive information security language in a contract that does not involve highly sensitive information. Finally, it would be all but impossible to impose one-off service level obligations in a small, noncritical Application Service Provider (ASP) deal, but those obligations may well be entirely appropriate in a large-scale transaction.

While the foregoing may seem obvious, we frequently see businesses proposing contract terms that are inappropriate for the contemplated engagement. In most cases, the problem arises from a failure to assess the transaction adequately from the outset. The reason for that failure is almost always a lack of clear foundational information about the transaction.

In this chapter, we identify key areas for which information should be obtained and understood before any review of draft contracts commences. By assessing this information, businesses can make more informed decisions about their proposed technology engagements and ensure their contracts are appropriate to those engagements. This list is not intended to be exhaustive. Other issues unique to a particular transaction or business should be added and, of course, the vendor should conduct appropriate due diligence.

Many businesses now require the foregoing information to be recorded in an internal “deal memo” and circulated to all relevant stakeholders (e.g., risk management, legal counsel, information security, and, of course, senior decision-makers). The deal memo is different from and should not be confused with a “term sheet,” which is designed to summarize the business terms of the deal. The term sheet will be circulated between the vendor and the customer. The deal memo is intended to be a purely internal document to educate relevant company stakeholders regarding the transaction. An example deal memo is provided at the end of the chapter.

Key Considerations

• ■ Executive description of engagement. Write a sentence or two describing in plain, nontechnical English what the deal is about, including a clear statement establishing the business advantage to be gained by entering into the contract. For example, “The license of a new expense tracking application designed to identify duplicate expenses more readily. Expected cost savings are projected to be $500,000 per year.” This type of description helps all those involved in the process immediately understand the nature of the transaction.
• ■ Useful life. Establish the anticipated duration of the contract, including desired renewal terms. In particular, if professional services will be rendered, what is the expected duration of those services (e.g., if software will be implemented, the duration of that implementation)? Will services take only a few weeks or will the services extend over many months? The longer the term of services, the greater the need for contractual protections relating to project management and cost control. Similarly, if a license is being granted, is the software being licensed for a term of years or perpetually? If for a term of years, the agreement should address renewal rights and the costs for renewal, including price protection for those renewals. Technology is constantly involving. In many cases, leading-edge products today are yesterday’s news in just a few years. This is why many technology agreements generally have relatively short initial terms (e.g., 2–5 years). The customer needs the ability to move to the next “big thing” and not be tied to outdated technology.
• ■ Expected fees. Describe the compensation due to the vendor over the life of the contract, inclu...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Dedication
• Table of Contents
• Acknowledgments
• About the Author
• Preface to the First Edition
• Preface to the Second Edition
• 1 Collecting Basic Deal Information
• 2 Software License Agreements
• 3 Nondisclosure Agreements
• 4 Professional Services Agreements
• 5 Statements of Work
• 6 Cloud Computing Agreements
• 7 Click-Wrap, Shrink-Wrap, and Web-Wrap Agreements
• 8 Maintenance and Support Agreements
• 9 Service Level Agreements
• 10 Idea Submission Agreements
• 11 Joint Marketing Agreements
• 12 Software Development Kit (SDK) Agreements
• 13 Key Issues and Guiding Principles for Negotiating a Software License or OEM Agreement
• 14 Drafting OEM Agreements (When the Company Is the OEM)
• 15 Original Equipment Manufacturer (OEM) Agreements
• 16 Health Insurance Portability and Accountability Act (HIPAA) Compliance
• 17 Reducing Security Risks in Information Technology Contracts
• 18 Website Assessment Audits
• 19 Critical Considerations for Protecting IP in a Software Development Environment
• 20 Transactions Involving Financial Services Companies as the Customer
• 21 Source Code Escrow Agreements
• 22 Integrating Information Security into the Contracting Life Cycle
• 23 Distribution Agreements
• 24 Data Agreements
• 25 Website Development Agreements
• 26 Social Media Policies
• 27 Critical Considerations for Records Management and Retention
• Glossary
• FFIEC Booklet
• Index