This post is a follow-up to January’s cybersecurity post discussing the cybersecurity considerations in performing due diligence in M&A transactions. The previous discussion can be found here. This post addresses two contractual provisions, the closing conditions and indemnification, which, if properly utilized, can protect acquiring companies from taking on too much cybersecurity risk in M&A transactions.
The period between a transaction’s signing and its closing is a time when the parties wait with bated breath, hoping that some catastrophic event does not occur that could bring the entire deal to a screeching halt. To allow an acquiring company to escape the deal if such an event should occur, the deal document often includes closing conditions requiring the target company to be free of any “material adverse event” during the relevant closing period. “Material adverse event” is usually a defined term that has some degree of generality, allowing the parties to argue whether a specific event triggers the ability to escape. However, even with businesses’ heightened cybersecurity sensitivity, the definition of “material adverse event” often does not consider potential cybersecurity breaches. Therefore, in the event of a cybersecurity breach of a target company, there may be uncertainty as to whether the parties are obligated to close the deal.
A simple solution to this uncertainty is to add a closing condition to the deal document requiring the absence of cybersecurity breaches prior to closing. As discussed in the previous post, cybersecurity vulnerabilities can easily go undetected, and this single provision can protect the acquiring company from being forced to acquire a business with potentially unquantifiable liability. A closing condition that addresses cybersecurity breaches is important for businesses operating in almost every industry, including those that handle consumer data, industries dependent on technology, and industries that use electronic payment systems. In order to conform with the specifics of a transaction, the closing condition can be crafted to the particular needs of any given industry or the size of any particular deal. For example, the condition may be tied to the expected number of customers impacted by a cybersecurity breach or tied to the breach of a specific system that is especially valuable to the parties. However, the specific parameters of this closing condition will be subject to negotiation, with the target looking to limit the breadth of a cybersecurity breach that could trigger the provision, and the acquiring company looking to include some generality to the provision, giving it flexibility to escape the deal when faced with a variety of potential cybersecurity liabilities.
It is in the acquiring company’s interest to negotiate for indemnification should a cybersecurity breach occur at the fault of the target or seller. The acquiring company’s most important consideration for such an indemnification provision is to adequately account for all losses that can stem from a cybersecurity breach. As discussed in the previous post, losses associated with cybersecurity breaches can be difficult to predict, may result in millions of dollars of liability, and often exceed insurance coverage. Therefore, the acquiring party will want to negotiate for indemnification that encompasses all losses associated with the cybersecurity breach, including the costs of complying with notification procedures mandated by state and federal law, remedying the underlying security failure, and defending against multiple lawsuits that are bound to arise from the compromise. Due to the unpredictability of potential losses, it will be in the acquiring party’s interest to remove cybersecurity losses from standard baskets and caps that may be found in other indemnification circumstances. On the other hand, the seller or target company will make all attempts to cap its indemnification requirement at some reasonable amount. In the end, the negotiation for indemnification will be decided on the parties’ respective confidence in the target’s cybersecurity protections and policies. Additionally, in cases where a breach triggers a closing condition as discussed above, the parties may decide to reset and renegotiate the indemnification provisions with shifted negotiating leverage.
The Key to Success
A party that adequately addresses cybersecurity issues in all aspects of an M&A transaction will be resistant to the volatile cybersecurity landscape that has developed in today’s business world. Although most companies have begun to implement cybersecurity policies in their business operations, the same degree of mindfulness is not always exhibited when parties negotiate for the sale of a business. In order to ensure a successful acquisition, the parties and their lawyers must be aware of cybersecurity risks and must be cognizant of the appropriate precautions to take when drafting deal documents.
Chris Brinkman practices in the firm's Business Representation & Transactions Group with a concentration in venture capital/private equity, start-ups & growth companies, securities, and mergers and acquisitions. Chris ...
Mark Musekamp practices in the firm's Business Representation & Transactions Group with a focus on intellectual property law. He regularly advises clients on non-patent intellectual property issues relating to trademarks ...
- Cybersecurity and Privacy Law
- Cybersecurity Regulation
- Data Breach
- Privacy Laws
- Class Action Litigation
- General Data Protection Regulation
- Mergers & Acquisitions
- Incident Response Plan
- Information Governance
- Corporate Law
- Federal Trade Commission
- Seventh Circuit
- Department of Justice
- Cyber Insurance
- September 2018 Was a Busy Month for Data Privacy
- GDPR - 90 Days Later
- GDPR: Less Than 100 Day and Counting to "G-Day" - Here's What You Need to Know
- SEC Issues Guidance on Cybersecurity Disclosures
- New D.C. Circuit Ruling Finds Substantial Risk of Harm Inherent to Data Breach
- Target Class Action Settlement Temporarily Upended
- Spokeo Continues to Divide the Lower Courts in Cybersecurity Litigation
- Cyber Breach Incident Notification Guidelines Ahead
- CyberSecurity News: Spokeo, Galaria and Braitberg
- Privacy Class Action Dismissed Under Spokeo