How do you negotiate MSA indemnification and insurance minimums without handing the economic loss to the vendor?

Brief

Three negotiation caps prevent MSA liability bleeding: cap at annual contract value (ACV), carve-outs for IP indemnity, and insurance floor tied to risk profile.

Detail

MSA liability is the #2 reason deals stall in legal (after data processing). Vendors often propose unlimited indemnity or 2-3× ACV caps; buyers counter with vendor-absorbing $25M liability floors. The settlement is typically 1-2× ACV with defined carve-outs.

Enterprise Indemnification Standard

Mutual Indemnity Baseline

Negotiation Playbook

Red Flags (Reject Immediately)

• "Indemnity capped at 10% of ACV" = Vendor accepts almost no risk
• "Indemnity unlimited for any reason" = Vendor accepts existential liability
• "Buyer liable for any IP claim regardless of vendor's use of code" = Buyer bears vendor's IP risk
• "Insurance required: $10M general liability" = Unrealistic for mid-market vendors

Negotiation Anchors

Anchor 1: IP Indemnity (Usually Unlimited, With Carve-Outs)

• Vendor starting position: "We'll defend against IP claims if someone sues because of our code."
• Your opening: "Acceptable. But IP indemnity applies only to unmodified vendor code. For your custom integrations, IP risk is shared."
• Settlement: "Unlimited IP indemnity for core product. Custom build IP indemnity capped at 2× ACV or project cost, whichever is smaller."

Anchor 2: Data Breach / Security (2× ACV Typical)

• Vendor starting position: "We maintain SOC 2 Type II. Any breaches are covered by insurance."
• Your opening: "Insurance backs claims; MSA caps liability. Data breach liability capped at 2× ACV, but applies only to breaches caused by vendor negligence (not 3rd-party hacks)."
• Settlement: "2× ACV for breaches caused by vendor failure to maintain reasonable security controls. Vendor provides proof of insurance for cybersecurity liability ($[amount] minimum)."

Anchor 3: Consequential Damages (Always Exclude)

• Vendor starting position: "Consequential damages, lost profits, business interruption excluded."
• Your opening: "Agreed. But direct damages from service outage are not consequential—they're direct. We want direct damages capped at 1-2× ACV."
• Settlement: "Vendor not liable for lost profits, lost revenue, reputational harm. But vendor IS liable for direct costs (e.g., emergency alternate solution, remediation labor) up to 1.5× ACV."

Insurance Minimums (Tied to Deal Size)

Carve-Out Language (Protects Vendor From Unrealistic Claims)

``` Vendor indemnity excludes claims arising from:

1. Customer's modification of vendor code (unless vendor approved)
2. Customer's use of product in manner not documented in SOW
3. Customer's failure to apply security patches within 30 days of vendor release
4. Acts of God, war, natural disaster, cyber attack by external parties (not vendor's fault)
5. Claims by third parties that customer created

```

Buyer Indemnity (Protects Vendor, Often Overlooked)

• Buyer indemnifies vendor for IP claims arising from buyer's data provided to vendor
• Example: "If customer's data includes stolen IP and vendor is sued, customer defends vendor"
• Typical cap: 1× ACV (lower than vendor indemnity because buyer data risk is buyer's responsibility)

Escalation Ladder If Vendor Won't Move

TAGS: MSA,indemnification,insurance,legal,liability-cap,enterprise-deals,negotiation,risk