A master service agreement checklist should cover eleven provisions that together govern an ongoing service relationship: scope and acceptance, payment and audit rights, intellectual property, confidentiality and data security, representations and warranties, indemnification and liability caps, insurance, force majeure, non-solicitation and assignment, legal compliance and worker classification, and termination with dispute resolution. The MSA itself is a framework document; the actual work lives in Statements of Work that sit under it. Build the framework correctly once and you stop renegotiating foundational terms every time a new project begins.
Below is what each provision needs to do, and where the drafting usually goes wrong.
Scope of Work and Acceptance
Keep the MSA general and push project-specific detail into individual SOWs. Each SOW should name the deliverables, the timeline, the technical requirements, and the quality benchmarks the work has to meet. When the project changes direction, document the revision in a written change order covering the revised scope, cost adjustment, and new timeline, signed by both parties before work continues. Oral change requests are the single most common source of billing disputes.
Acceptance Criteria
Every SOW needs a formal acceptance process. Define a review period that begins when the client receives the deliverable, the criteria it will be measured against (completeness, technical accuracy, adherence to specifications), and the method for communicating approval or rejection. A rejection notice should describe the specific deficiencies so the provider knows what to fix.
Give the provider a remediation window of five to ten business days to correct rejected work and resubmit. After repeated failures, the client should have the right to terminate the SOW for cause, bring in a third party to finish the work, or recover costs. Without this process, both sides will argue indefinitely about whether a deliverable was “done.”
Performance Standards
State how performance will be measured. “Commercially reasonable efforts” is the standard default, meaning the provider pursues results the way a competent professional in the same field would. For ongoing services rather than discrete deliverables, include service level agreements with measurable metrics such as uptime percentages, response times, or error rates, and attach consequences for missing them. Billing credits are the most common SLA remedy.
Payment Terms and Audit Rights
Specify invoicing frequency (monthly, milestone-based, or on delivery) and the payment window. Net 30 means the client has 30 days from the invoice date to pay; Net 60 gives them 60. Short windows favor the provider’s cash flow; clients with internal approval cycles tend to push for longer.
State the late-payment interest rate explicitly. One percent to 1.5% per month on unpaid balances is standard in commercial contracts. Restrict payment methods to electronic transfers or other traceable options so both parties keep a clear audit trail.
Expense Reimbursement
Reimbursable expenses — travel, software licenses, materials — should require written pre-approval from the client before the provider incurs them, and the MSA should require itemized receipts or standardized expense reports. Without pre-approval, providers sometimes spend liberally and surprise the client with the invoice.
Right to Audit
Negotiate a right-to-audit clause allowing the client to review the provider’s financial records, time-tracking systems, and billing documentation for accuracy. This matters most in time-and-materials engagements. Define the advance notice required (10 to 30 business days is typical) and specify that the provider bears the audit’s cost if material discrepancies are found. The clause doubles as a compliance check, letting the client confirm that work isn’t being quietly outsourced to unauthorized subcontractors.
Tax Responsibilities
Each party should handle its own taxes, including federal income tax and any applicable sales or use tax. If services are subject to sales tax in a given jurisdiction, say who collects and remits it.
Intellectual Property Ownership
IP is where the real financial exposure lives in most MSAs. The threshold question is whether deliverables qualify as a “work made for hire” under federal copyright law.
Work Made for Hire
If a provider’s employees create the work within the scope of their employment, work-for-hire treatment can apply automatically. For specially commissioned work from an independent contractor, the Copyright Act limits the designation to nine categories: contributions to a collective work, parts of an audiovisual work, translations, supplementary works, compilations, instructional texts, tests, answer material for tests, and atlases. Both parties must also sign a written agreement stating the work is made for hire.
Most custom software, marketing materials, and business consulting deliverables fall outside those nine categories. In that situation, labeling the deliverable a “work made for hire” has no legal effect, and the provider retains copyright by default.
Assignment as a Backup
Because so many deliverables miss the work-for-hire categories, include a written assignment clause transferring all copyrights, patents, and other IP rights to the client. Federal law requires copyright transfers to be in writing and signed by the rights holder. The assignment clause is the safety net for everything work-for-hire doesn’t catch.
Background IP and Licensing
Providers often bring pre-existing tools, code libraries, or frameworks into a project. Background IP should stay the provider’s property, with the client receiving a non-exclusive, royalty-free license to use it solely in connection with the deliverables. Document what the provider brings into each SOW at the start, before anyone has an incentive to misremember.
Moral Rights
In some jurisdictions, creators keep “moral rights” after assigning copyright, including the right to be credited and to object to modifications that damage their reputation. Include a waiver of moral rights to the fullest extent permitted by law, along with the creator’s consent to modifications, the client’s right to publish without attribution, and an agreement not to assert moral rights after the relationship ends.
Confidentiality and Data Security
Define what counts as confidential information. At minimum, cover proprietary business data, trade secrets, customer lists, financial records, and any technical specifications shared during the engagement. Vague language like “sensitive information” invites disputes about what’s actually protected.
Duration and Exceptions
Confidentiality obligations should survive termination, typically for three to five years. Trade secrets deserve indefinite protection because their legal status depends on remaining secret; a five-year expiration can destroy that status. Standard exceptions cover information that becomes public through no fault of the recipient, information the recipient already possessed, and information independently developed without using confidential materials.
Security Standards
If the provider handles client data, spell out minimum security requirements. Encryption standards (such as AES-256), multi-factor authentication, and access controls are common baselines. For providers that store or process significant client data, SOC 2 compliance is increasingly standard. A SOC 2 report is an independent audit evaluating the provider’s controls across five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Require the provider to maintain current certification and share the report annually.
Data Breach Notification
Require the provider to notify the client of any security incident within a specific window; 24 to 72 hours after discovery is the common contractual range. The notice should describe what happened, what data was affected, what remediation is underway, and the expected timeline. Require cooperation on the investigation, including preserving forensic evidence and assisting with regulatory notifications. A vague “we’ll let you know” obligation gives the provider little reason to move quickly.
Subcontractor Obligations
Any subcontractor or employee with access to confidential information must be bound by equivalent non-disclosure terms. Require the provider to flow down confidentiality and security obligations and hold the provider responsible for any subcontractor breach.
Representations and Warranties
Representations and warranties are the promises each party makes about its status and ability to perform. They look like boilerplate until one proves false and becomes the basis for a breach claim.
Mutual Representations
Both parties should represent that they are legally organized and in good standing, have authority to enter the agreement, and that signing won’t violate any other contract they’re bound by. Each should also confirm there is no pending litigation that could materially affect performance.
Provider-Specific Warranties
The provider should warrant that services will be performed in a professional and workmanlike manner, consistent with generally accepted industry standards. If the work requires specific licenses or certifications (professional engineering, healthcare, security clearances), require the provider to hold and maintain them throughout the engagement. The provider should also warrant that deliverables won’t infringe any third party’s intellectual property rights, which ties directly into the indemnification obligations below.
Indemnification and Limitation of Liability
This section decides who pays when things go wrong and has more financial impact than almost anything else in the agreement.
Indemnification
An indemnification clause requires one party to cover the other’s losses from specific claims. Common triggers include third-party IP infringement by the provider’s deliverable, negligence or misconduct by the provider’s personnel, and breaches of confidentiality. The indemnifying party typically takes on both the financial liability and the duty to defend, meaning they hire and pay for the lawyers.
Watch for asymmetry. Providers often ask the client to indemnify them against claims arising from client specifications or unintended use of deliverables, which is reasonable. One-sided indemnification is not.
Liability Caps
A liability cap sets the maximum either party can owe for claims under the agreement. The common structure ties the cap to fees paid or payable, with one times the annual fees as the market standard for general liability. For higher-risk obligations such as data breaches or IP infringement, parties often negotiate a “super cap” of two to five times annual fees. Certain categories are typically excluded from any cap: liability for gross negligence or willful misconduct, breaches of confidentiality, indemnification obligations, and bodily injury or property damage.
Consequential Damages Waiver
Most MSAs include a mutual waiver of consequential damages such as lost profits, lost revenue, reputational harm, and lost business opportunities. The waiver limits recovery to direct damages and usually applies regardless of the legal theory, even if the other party was warned the damages were possible. Common carve-outs mirror the liability cap exclusions: gross negligence, willful misconduct, confidentiality breaches, and IP infringement.
Insurance Requirements
Insurance is the fallback when indemnification and liability caps run out. Specify minimum coverage types and amounts. Most clients require at least the following:
- Commercial general liability covering bodily injury and property damage, with a $1 million per-occurrence limit and $2 million aggregate as the standard for most service engagements.
- Professional liability (errors and omissions) covering claims from the provider’s professional mistakes or negligent advice. This is critical for consulting, technology, and financial services providers.
- Workers’ compensation, which nearly every state requires for providers with employees.
- Cyber liability, which is increasingly required when the provider handles client data and covers the cost of breach response, notification, and resulting claims.
Require the provider to name the client as an additional insured on the general liability policy, not just a certificate holder. A certificate holder only receives proof the policy exists; an additional insured gains coverage under the policy and can file claims directly with the insurer if sued over the provider’s work. The provider should deliver updated certificates annually and notify the client before any material change in coverage.
Force Majeure
A force majeure clause excuses performance when extraordinary events beyond either party’s control make performance impossible or impractical. Without one, a party that can’t perform because of a natural disaster, pandemic, or government action is technically in breach and has to rely on common-law defenses like impossibility or frustration of purpose, which are harder to prove.
List specific qualifying events: natural disasters, wars, terrorism, government orders, embargoes, pandemics, labor strikes, and widespread infrastructure failures. Courts interpret force majeure narrowly, so vague catch-all language like “any event beyond the party’s control” may not cover your situation.
A workable clause also addresses:
- Notice: the affected party must notify the other promptly, with details about the event, its impact on performance, and the expected duration.
- Mitigation: the affected party must take reasonable steps to minimize the disruption rather than simply stopping work.
- Suspension versus termination: whether the contract is suspended during the event or whether either party can terminate if the disruption exceeds a defined period, with 60 to 180 days common.
- Financial consequences: whether fees continue during suspension, and whether the client can reduce scope or seek alternative providers in the meantime.
Non-Solicitation and Assignment Restrictions
Non-Solicitation of Employees
When a provider embeds staff at a client’s site, or the reverse, both sides become familiar with the other’s talent. A non-solicitation clause prevents either party from recruiting or hiring the other’s employees for a specified period, typically 12 to 24 months after the engagement ends. Standard exceptions allow hiring someone who responds to a general job posting not targeted at the other party’s employees, or whose employment ended before any solicitation.
Make the obligation mutual. Clients sometimes resist reciprocity, but a provider who loses a key engineer to the client mid-project has the same reason to object.
Assignment Restrictions
An assignment clause governs whether either party can transfer the agreement or its rights and obligations to a third party. Most MSAs prohibit assignment without the other party’s prior written consent. You chose your provider or client for a reason, and neither side should wake up to find the agreement handed to an unknown company.
The common exception allows assignment to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets. Even with that exception, require written notice and confirm the assignee is bound by all existing terms.
Compliance With Laws and Worker Classification
Require both parties to comply with applicable federal, state, and local laws in performing their obligations. Without an express compliance clause, a party’s regulatory violation doesn’t automatically breach the MSA, and you’d need a separate claim.
Worker Classification
If the provider uses independent contractors rather than employees, misclassification risk falls on both parties. The IRS evaluates worker status using three categories: behavioral control (whether the company directs how the worker does the job), financial control (who controls the business aspects such as expenses, tools, and payment method), and the type of relationship (whether it’s ongoing and whether the work is a key part of the business). Getting this wrong can expose the provider and sometimes the client to back taxes, penalties, and wage claims.
Include a representation from the provider that all personnel are properly classified, and an indemnification obligation covering losses if that proves false. If the engagement looks like it could blur the line (long-term, full-time, on-site work using the client’s tools), flag it early and structure the relationship accordingly.
Industry-Specific Regulations
If services involve personal health information, the provider likely needs to sign a HIPAA business associate agreement as a supplement to the MSA. For financial data, write PCI-DSS compliance requirements into the security provisions. Data privacy laws at both federal and state levels are expanding, and the MSA should require the provider to comply with applicable privacy regulations and implement reasonable administrative, physical, and technical safeguards for any personally identifiable information it handles.
Termination, Transition, and Dispute Resolution
Termination for Cause
Define what constitutes a material breach and give the breaching party a cure period, typically 15 to 30 days from written notice, to fix the problem before the other side can terminate. Common material breaches include failure to pay, failure to deliver, breach of confidentiality, and violation of applicable laws. If the breach is incurable, such as a catastrophic data leak, the non-breaching party should be able to terminate immediately.
Termination for Convenience
A termination-for-convenience clause lets either party walk away without alleging a breach, usually by providing 30 to 90 days’ written notice. This is standard in government contracts and has become equally common in private-sector MSAs. The clause should address what happens to in-progress SOWs: whether they end at the same time or continue to completion, and whether the provider is paid for work completed through the termination date.
Transition Services
Termination provisions that ignore what happens the day after are incomplete. Require the provider to cooperate in an orderly transition, including returning or destroying all client data, transferring work in progress to the client or a successor provider, and giving reasonable knowledge-transfer support. Define the maximum transition period (30 to 90 days post-termination is typical) and specify whether the provider is compensated for transition assistance or whether it’s included as an obligation under the agreement.
Survival
Certain provisions need to outlast the agreement. Include a survival clause identifying which sections remain in effect after termination. At minimum, confidentiality, indemnification, limitation of liability, intellectual property ownership, dispute resolution, and any payment obligations for completed work should survive.
Dispute Resolution
Specify a governing law (typically the law of the state where one party is headquartered) and a venue for resolving disputes. Many MSAs require escalation through informal negotiation first, then mandatory mediation, before either side can file a lawsuit or initiate arbitration. The American Arbitration Association provides standard clause language requiring mediation before binding arbitration, with the arbitrator’s decision enforceable in any court with jurisdiction.1American Arbitration Association. AAA Clause Drafting
Arbitration is generally faster and more private than litigation, but the decision is final and binding with very limited appeal grounds. Include a prevailing-party fee-shifting provision if you want the losing side to reimburse the winner’s legal costs; without one, each party bears its own fees regardless of outcome.