Cybersecurity Services Agreement NZ Clause Checklist

Cybersecurity work often starts with urgency. A client needs an audit before a board meeting, wants managed monitoring turned on this week, or calls you during a live incident and asks you to jump in right away.

That can be good for business, but it also means you need a clear written agreement before you access systems, handle sensitive data or make recommendations the client may rely on.

A strong cybersecurity services agreement in NZ doesn't need to be full of legal jargon. It should clearly explain what you're doing, what you're not doing, what the client must give you, and how risk is shared if something goes wrong.

Do You Need A Cybersecurity Services Agreement In NZ?

Yes, you should use a written cybersecurity services agreement before providing audits, monitoring, testing, incident response or managed security services.

Cybersecurity is a high-trust, high-risk service. You're often dealing with admin credentials, network diagrams, personal information, confidential business data and urgent decisions. If your agreement is vague, you may end up responsible for risks you never priced into the work.

A good agreement helps you lock in the commercial basics, including:

• what services you're providing and when
• what systems, users, locations and accounts are included
• what the client must provide before you can start
• what fees apply for standard work and emergency work
• what reports, alerts or recommendations you'll deliver
• what liability cap applies if a claim is made

It also helps with New Zealand compliance issues. For example, if you handle personal information while investigating an incident, the Privacy Act 2020 may be relevant. If there's a notifiable privacy breach, the affected organisation may need to notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware there are reasonable grounds to believe the breach is notifiable.

Your contract should make it clear who is responsible for making those notifications. As the consultant or MSP, you may support the process, but your client usually remains responsible for its own legal compliance.

What Should Your Scope Of Work Cover?

Your scope of work, often attached to a service agreement, should spell out exactly what you're doing, what systems are covered and what deliverables the client will receive.

This is where many cyber security contracts in NZ fall down. Words like security review, monitoring or incident response support can mean very different things to different people. If the client expects 24/7 threat hunting and you priced for monthly log review, you'll have a problem.

Core Scope Details

Your agreement should cover:

• Services: audits, penetration testing, vulnerability scanning, managed detection, security awareness training, incident response, policy review or advisory work.
• Systems: cloud accounts, endpoints, firewalls, websites, SaaS tools, identity systems, backups, email platforms and third-party integrations.
• Timeframes: start date, estimated completion dates, reporting dates and any renewal periods.
• Deliverables: reports, risk ratings, executive summaries, remediation plans, alerts, tickets or incident logs.
• Service levels: response targets, monitoring windows and escalation pathways, often in a service level agreement, if you're offering managed services.

Exclusions Matter Just As Much

Your exclusions should be direct. For example, your agreement might say you don't guarantee that the client's environment is free from vulnerabilities, that you don't provide legal, insurance or tax advice, and that remediation work is only included if it's listed in the scope.

This protects both sides. Your client knows what they're paying for, and you avoid being treated as the all-purpose owner of their cyber risk.

What Client Responsibilities Should You Put In The Agreement?

You should include client responsibilities for access, information, approvals, backups, internal decisions and legal compliance.

Cybersecurity work depends heavily on what your client does. If they give you old network diagrams, delay access approvals or ignore urgent recommendations, your work can be slowed down or made less useful. Your agreement should say this plainly.

Useful client responsibility clauses include:

• Access: the client must provide timely access to systems, logs, devices, staff and third-party platforms.
• Accuracy: the client must give you accurate and complete information about its environment.
• Authority: the client confirms it has permission for you to test, scan or access the relevant systems.
• Backups: the client remains responsible for maintaining proper backups unless backup management is clearly included in your services.
• Remediation: the client decides whether to implement your recommendations unless you have agreed to do that work.
• Compliance: the client remains responsible for its obligations under laws such as the Privacy Act 2020, the Fair Trading Act 1986 and any industry rules that apply to its business.

Say Priya runs a managed security service for a Wellington software company. Her team flags that multi-factor authentication is missing for 25 admin users and recommends urgent changes within 48 hours. The client waits three weeks because the CFO is overseas. If an account is compromised during that delay, Priya's agreement should make it clear that she isn't responsible for the client's decision not to act on the recommendation.

If you use subcontractors or independent specialists, your agreement should also cover who may access client systems and what confidentiality obligations apply. If you engage people as contractors, the Employment Relations Act 2000 and the Employment Relations Amendment Act 2026 contractor gateway test may also be relevant to how you structure those working relationships.

Can You Limit Your Liability For Cybersecurity Work?

Yes, you can often limit your liability in a cybersecurity services agreement, but the clause needs to be drafted carefully and should match the risk of the work.

A cybersecurity liability clause usually sets a cap on how much you may have to pay if something goes wrong. Without one, your potential exposure can be much larger than the fee you charged.

Common liability cap options include:

• a fixed dollar amount
• the fees paid for the affected project
• the fees paid in the last 3, 6 or 12 months
• a higher cap for some risks, such as confidentiality or data breaches

For example, say you charge $4,000 plus GST per month for managed monitoring, and your agreement caps liability at the fees paid in the previous 12 months. If a covered claim is made after a full year of services, the cap would be $48,000 plus GST. That may be commercially sensible for routine monitoring, but it may be too low or too high depending on the client, the systems involved and your insurance cover.

Your agreement should also exclude certain losses where appropriate, such as loss of profit, loss of revenue, loss of data, reputational damage or indirect losses. These exclusions need to be clear and fair in context.

New Zealand consumer laws can affect how far you can go. The Consumer Guarantees Act 1993 can apply to some services, and business parties may be able to contract out in writing if both are in trade and it's fair and reasonable. The Fair Trading Act 1986 also affects how you describe your services, results and guarantees. You shouldn't promise outcomes you can't control, such as making a system fully secure against all attacks.

What Should Happen With Emergency Work And Incident Response?

Your agreement should set clear rules for emergency work, because incident response usually happens fast and outside normal project boundaries.

During a live cyber incident, clients often ask you to start immediately. That might mean after-hours calls, urgent access to systems, working with insurers, preserving evidence, or bringing in extra specialists. If your contract doesn't cover this, you may struggle to recover fees or manage expectations later.

Emergency Work Clauses To Include

Your incident response terms should cover:

• Authority to act: who can approve urgent work and spending on the client's side.
• Rates: whether after-hours, weekend or public holiday rates apply.
• Minimum blocks: whether urgent work is billed in minimum time blocks.
• Third-party costs: when the client must pay for forensic tools, cloud costs, specialist support or travel.
• Priorities: whether containment, evidence preservation, recovery or reporting comes first.
• Limits: what you won't do, such as negotiating ransom payments or giving legal advice.

It's also sensible to include an emergency change process. For example, you may start urgent containment work based on written approval by email or ticket, then confirm a fuller scope within 24 hours once the immediate risk is clearer.

Privilege can also matter during incident response. Communications with a cybersecurity consultant are unlikely to be protected by legal professional privilege on their own. If your client needs privileged legal advice or a privileged investigation strategy, they should speak with their own lawyer about how the work should be structured.

What Clauses Should You Include In A Managed Security Services Agreement?

A managed security services agreement should include ongoing service terms, monitoring details, escalation rules, privacy controls and termination rights.

If you're moving from one-off projects into recurring monitoring, managed services or MSP work, your agreement needs more than a standard IT services agreement template. Managed services involve ongoing reliance, recurring fees, access to live systems and continuing decisions about alerts.

Here is a practical outline you can use as a starting point. A lawyer should tailor it before you use it with clients, because templates often miss the details that matter for your business model.

1. Parties And Background: write who you're contracting with, including the legal entity name and NZBN if available.
2. Services: describe the audits, monitoring, advisory work, incident response or support included.
3. Service Levels: set response targets, monitoring hours, exclusions and escalation paths.
4. Client Responsibilities: list access, approvals, backups, information and compliance obligations.
5. Fees And Payment: include retainers, project fees, emergency rates, expenses and payment timing.
6. Change Control: explain how extra work, new systems or changed priorities are approved.
7. Confidentiality And Security: cover confidential information, credentials, secure storage and access controls.
8. Privacy: explain how personal information will be handled and who manages Privacy Act 2020 notifications.
9. Intellectual Property: state who owns pre-existing tools, scripts, playbooks, reports and customised materials.
10. Liability And Insurance: set caps, exclusions and any insurance expectations.
11. Term And Termination: include renewal, suspension for non-payment, offboarding and return of access.
12. Subcontractors: explain when you can use them and what standards they must meet.

You may also need clauses dealing with IPONZ-registered trade marks if your reports, tooling or training materials use your brand. For companies, check that the client name matches the Companies Office records, because contracting with the wrong entity can make payment and enforcement harder.

Common Mistakes To Avoid

The biggest mistake is treating cybersecurity services like ordinary technical support, when the risk profile is usually much higher.

Here are the issues we see most often in cyber and MSP agreements:

• Using broad service descriptions: terms like cyber support or security management can create expectations you didn't intend to accept.
• Forgetting exclusions: if remediation, legal reporting, ransom advice or backup restoration aren't included, say so.
• No written emergency approval process: urgent work should still have a clear authority trail.
• No liability cap: cyber claims can be large, so the cap should be agreed before the work starts.
• Overpromising results: don't say you'll prevent all breaches or guarantee compliance if you can't control the client's systems and staff.
• Ignoring privacy roles: if you process personal information, the contract should say how it's protected and who handles breach notifications.
• No offboarding process: when the engagement ends, you should know how access is revoked, data is returned and tools are removed.

It's also worth checking your insurance before signing client terms. Some professional indemnity or cyber policies require certain contract wording, exclude particular types of work, or set conditions for incident response services. Your agreement should work with your insurance, not against it.

If a larger client gives you their own supplier contract or services agreement, read it closely. It may include unlimited liability, broad indemnities, strict security schedules or audit rights that don't fit your pricing. Those clauses can often be negotiated, but it's much easier to do that before the project starts.

Key Takeaways

• A cybersecurity services agreement in NZ should clearly define the services, systems, deliverables and exclusions.
• Client responsibilities are critical, especially around access, approvals, backups, remediation and legal compliance.
• Your liability clause should set a sensible cap and avoid promises you can't control.
• Emergency work needs its own rules for approvals, rates, third-party costs and incident response priorities.
• Privacy Act 2020 obligations should be addressed, especially if your work involves personal information or breach response.
• Managed security services need ongoing terms for service levels, escalation, change control, offboarding and subcontractors.

If you'd like help with your cybersecurity services agreement, liability clauses, managed services terms or incident response contracting process, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.