Cybersecurity: More Than A Byte-Sized Problem In M&A - Part Two: The Transaction Agreement

In a previous blog entry, we offered a brief review of cybersecurity issues that can arise in the course of M&A transactions and discussed the importance of cybersecurity due diligence by the buyer. This entry will focus on contractual provisions that the buyer can request in the definitive transaction agreement to hedge against any cybersecurity risks it assumes. In particular, this blog post will focus on purchase price adjustments, representations and warranties, and indemnities.

Purchase Price Adjustments

Where the due diligence phase of the transaction has revealed risks and vulnerabilities in the target's cybersecurity systems, policies or practices, the buyer must decide how it wishes to proceed. If the risks or vulnerabilities of the target's systems are significant, or if the target's systems are compromised or outdated, the value of the target may be affected. The buyer may seek to negotiate the deal to reflect the assumption of risk or to account for