Review Msa Deep Review Sboghossian

---
name: review-msa-deep-review-sboghossian
title: MSA Deep Review
description: Use when conducting a comprehensive review of a Master Services Agreement (MSA) or equivalent commercial services framework agreement. Covers all high-leverage clauses — liability cap, indemnification, IP ownership of deliverables, termination, SLA, data, audit rights, most-favored-customer, and term/renewal — with severity ratings and recommended positions. Takes approximately 30–60 minutes of focused review time. Links to specialist sub-review skills for deep-dives.
author: sboghossian
author_url: https://github.com/sboghossian/mini-claude-for-legal/tree/main/skills/review/review-msa-deep-review
license: MIT
version: 0.1.0
execution_mode: open
jurisdiction: general
practice: contracts
language: en
---

# MSA Deep Review

## When to use this

Use when you need a full commercial review of a Master Services Agreement or substantially similar services framework (Managed Services Agreement, Professional Services Agreement, Enterprise License Agreement with services components, IT Outsourcing Agreement). This is a comprehensive, high-effort review — plan for 30–60 minutes of focused work.

Typical triggers:
- High-value or strategic vendor engagement (multi-year, AED/USD 500K+)
- Enterprise SaaS with significant data processing obligations
- Outsourcing arrangement where the provider will have access to Client's systems or data
- Acquisition due diligence on a target company's material contracts
- Pre-signing review of counterparty's paper

For a quick NDA review, use [[review-nda-quick-check]]. For clause-level risk flagging as a first pass, use [[review-risk-flagging]].

## Inputs

| Input | Why it matters | Default |
|---|---|---|
| MSA draft + all schedules | Full document including SOW template, DPA, SLA, pricing schedule | Required |
| Party perspective | Client vs Provider framing changes the priority of findings | Ask |
| Deal context | Contract value, term, data sensitivity, IP at stake | Helpful; infer from document |
| Jurisdiction | Governs enforceability of caps, non-competes, IP assignment | From governing-law clause |
| Prior negotiations | Any agreed positions — avoids re-opening closed items | Ask |

## Review Methodology

Run in two passes:

**Pass 1 — Structural completeness**: verify all standard MSA components are present (use [[review-missing-clauses]] checklist for MSA type).

**Pass 2 — High-leverage clause analysis**: deep-dive the ten clauses that determine who bears the real risk. For each, rate severity and recommend a position.

---

## High-Leverage Clause Analysis

### Clause 1 — Liability Cap

Rate: Is the cap reasonable for this deal?

Key questions:
- What is the cap structure? (12-month fees / 24-month / 2× annual / TCV / fixed amount)
- Does the cap apply to all damages including IP infringement? (red flag — IP should be carved out)
- Does the cap apply to data breach + regulatory fines? (red flag — regulatory fines are statutory)
- Are carve-outs consistent between this clause and the indemnification section?
- Is the cap enforceable in the governing jurisdiction? (civil-law courts can adjust; UK requires reasonableness test)

Escalate to [[review-liability-cap-reasonableness]] for full analysis.

Common patterns by contract type:

| Contract type | Typical Provider cap | Typical Client cap |
|---|---|---|
| SaaS (general) | 12-month fees | 12-month fees |
| SaaS (high data sensitivity) | 12-month fees + data breach uncapped | 12-month fees |
| IT Outsourcing | 12–24 months | TCV |
| Professional Services | 12-month fees | Fees paid for relevant services |
| Construction / FIDIC | Contract Price | Contract Price |

---

### Clause 2 — Indemnification

Key questions:
- Scope: third-party claims only? Or does it extend to direct losses between the parties?
- IP indemnification: does Provider indemnify Client for third-party IP infringement claims arising from use of the Provider's deliverables? (market standard: yes)
- Data breach: who bears indemnification for a breach of the DPA?
- Procedure: notice, defense control, settlement consent — all present?
- Cap alignment: are IP and data-breach indemnities carved out of the general cap?

Escalate to [[review-indemnification-balance]] for full analysis.

---

### Clause 3 — IP Ownership of Deliverables

Key questions:
- Are bespoke deliverables (custom software, reports, content) assigned to Client? Or retained by Provider?
- Is the assignment language present-tense ("hereby assigns") or executory ("agrees to assign")?
- Are background IP and pre-existing tools carved out?
- Is a license-back of background IP granted with an adequate scope and survival period?
- Are open-source components disclosed? Any copyleft contamination?
- What happens to IP on termination — does Client retain what it has paid for?

Escalate to [[review-ip-ownership-clarity]] for full analysis.

---

### Clause 4 — Termination

Key questions:
- Termination for convenience: available to which parties? Notice period? (market: 30–90 days for either party)
- Termination for material breach: is "material breach" defined? Cure period (typically 30 days)? Is right of cure limited to remediable breaches only?
- Acceleration of fees: on termination for convenience, does the terminating party owe remaining fees? (Provider-favorable; Client should resist for T4C by Client)
- Transition services: is Provider obligated to assist Client in transitioning to a new provider for some period post-termination? (critical for IT outsourcing and SaaS with Client data)
- Data return: on termination, within what timeframe does Provider return or delete Client data?

Red flags:
- No termination for convenience — parties locked in until term expires with no exit
- Material breach not defined — anything could be "material" or nothing could be
- No transition assistance obligation — Client left stranded on exit
- Fees continue to accrue during cure period after Client gives notice — double payment trap

---

### Clause 5 — Service Level Agreement (SLA)

Key questions:
- Are service levels specified? (Uptime %, response time, resolution time)
- How is measurement done? (Provider-reported? Third-party monitoring? Client audit right?)
- What are the remedies for SLA failure? (Service credits — rate and cap)
- Is the service credit the **exclusive** remedy for SLA failure? (common; flag if yes — prevents Client from claiming actual damages for outage)
- Are there exclusions from SLA measurement? (Scheduled maintenance, Client-caused failures — should be limited and transparent)
- Is there a persistent SLA failure termination right? (e.g., right to terminate if SLA failure exceeds X% in Y months)

Red flags:
- No SLAs at all — Provider's obligation is just "reasonable efforts"
- Service credits as exclusive remedy with a very low cap (e.g., 10% of monthly fees) — inadequate for high-availability requirements
- No persistent-failure termination right

---

### Clause 6 — Data Processing and Privacy

Key questions:
- Is a Data Processing Agreement (DPA) attached? (mandatory where personal data of EU/UK/KSA/UAE residents is processed)
- Data residency: where are Client's data stored? Does this comply with applicable cross-border transfer restrictions?
- Subprocessors: is there a list of approved subprocessors? Can Provider add subprocessors without Client consent?
- Breach notification: within what timeframe must Provider notify Client of a personal data breach? (Must be short enough for Client to meet its own 72-hour regulatory obligation)
- Data deletion/return: specific obligation on timing and format of data return or deletion on termination?
- Security standards: what technical and organizational security measures does Provider commit to? (ISO 27001, SOC 2, etc.)

Jurisdiction note: if any party or data subject is in KSA, UAE (onshore), DIFC, ADGM, EU, or UK — the DPA is not optional. Its absence is a compliance breach.

---

### Clause 7 — Audit Rights

Key questions:
- Does Client have the right to audit Provider's compliance with the agreement? (financial audit, security audit, data audit)
- Frequency: typically once per year with 30 days' notice
- Cost: Client usually bears audit cost; Provider bears cost of remediation
- Scope: is it limited to the relevant Services / data? (avoid granting unlimited access to Provider's systems)
- Confidentiality of findings: audit results should be treated as confidential
- Inspector qualifications: independent third-party auditor (not Client's general staff)

Red flags:
- No audit right at all for a data-processing engagement
- Audit right is purely a right to "ask questions" with no right to access records
- Provider can refuse audit on confidentiality grounds with no arbitral override

---

### Clause 8 — Most-Favored-Customer (MFC)

Key questions:
- Does the MFC apply to pricing only? Or to all contractual terms?
- If pricing MFC: retroactive (Provider must refund the delta if it gives a better price to anyone)? Or prospective only?
- Scope: compared to all customers? Or a defined group (similarly-situated customers, same volume tier)?
- Duration: does it survive term expansion or renewal?

MFC is a significant obligation on the Provider — verify that the Client actually needs it given the deal dynamics. If included, mark retroactive MFC as a high-risk item for Provider side.

---

### Clause 9 — Term and Renewal

Key questions:
- Initial term and auto-renewal mechanics?
- Notice period for non-renewal: if notice for non-renewal must be given 90+ days before auto-renewal, the auto-renewal trap is a material risk (common in SaaS contracts)
- Term-end pricing protections: if the contract renews at a higher price without negotiation, Client may be locked into unfavorable pricing
- Most favored pricing at renewal: ensure renewal pricing is at least equivalent to current market

Red flags:
- Auto-renewal notice window greater than 60 days (creates trap for clients who don't track deadlines)
- Renewal at "then-current list prices" — may be materially higher than original pricing

---

### Clause 10 — Change Control

Key questions:
- Is there a change control process (Change Order / Statement of Work amendment)?
- Who has authority to approve changes?
- Does verbal approval bind either party to additional fees?
- Is there a mechanism to resolve disputes about whether work falls within existing scope?

Red flags:
- No change control process — Provider can claim any additional work was "in scope" or Client can refuse to pay for extra work
- Changes bind Client upon written acceptance — but acceptance is defined too broadly (e.g., commencing to use new feature)

## Output Format

Produce a top-10 findings list:

| Rank | Clause | Issue | Severity | Recommended Position | Fallback |
|---|---|---|---|---|---|
| 1 | Liability Cap | Cap applies to IP indemnity — no carve-out | Critical | IP indemnity uncapped | Separate sublimit at 2× annual fees |
| 2 | Data Processing | No DPA attached; GDPR/PDPL compliance gap | Critical | Attach standard DPA with SDAIA clauses | Require DPA execution before go-live |
| ... | ... | ... | ... | ... | ... |

Severity: Critical = potential regulatory violation or unlimited liability; High = material commercial exposure; Medium = suboptimal but manageable; Low = best-practice gap.

## Jurisdictional Notes

**DIFC / ADGM**: Common-law jurisdiction; English-style drafting conventions apply; DIFC and ADGM both have their own Data Protection Laws that require a DPA where personal data is processed.

**KSA**: Arbitration clauses must be explicit — specify SCCA/ICC, seat, language, number of arbitrators. IP assignments require specific present-tense language. PDPL DPA requirements apply where Saudi personal data is processed.

**UAE (onshore)**: Federal Data Protection Law (applicable alongside emirate-level rules); penalty clauses are adjustable by courts; IP assignment by future works requires care.

**Lebanon**: USD denomination for long-term contracts given currency instability; force majeure provisions should address banking and regulatory restrictions.

## Related Skills

- [[review-indemnification-balance]]
- [[review-liability-cap-reasonableness]]
- [[review-ip-ownership-clarity]]
- [[review-risk-flagging]]
- [[review-missing-clauses]]
- [[draft-msa]]
- [[review-nda-quick-check]]