1
Identify the contracting entities and effective date
Enter the full registered legal names of both the provider and the customer, their entity types, and the state or country of incorporation. Set the effective date to the date of last signature, not the date the document was drafted.
💡 Cross-reference both entities against corporate registry filings before execution — a misspelled legal name can void the agreement in some jurisdictions or complicate enforcement.
2
Define the service and attach or reference order forms
Write a clear, concise definition of the service being subscribed to and confirm that Order Forms or Statements of Work will govern the specific pricing, seat counts, and term for each purchase. Attach the first Order Form as Exhibit A.
💡 Keep service descriptions at a functional level in the MSA body — avoid enumerating specific features that may change. Reserve feature-level detail for the Order Form or a Product Schedule.
3
Set fees, billing frequency, and renewal pricing terms
Specify payment timing (net 30 is standard for B2B), late-fee rate, acceptable payment methods, and the notice period required before any renewal price increase takes effect. Reference the Order Form for the specific dollar amounts.
💡 A 90-day renewal price-increase notice window is the enterprise market standard — it prevents the most common billing dispute trigger in SaaS contracts.
4
Negotiate and document the SLA commitments
Agree on the uptime percentage, measurement window (monthly is standard), excluded maintenance windows, and the credit formula for breaches. Document the incident reporting and credit-request process clearly.
💡 Make service credits the exclusive remedy for SLA breaches — but carve out gross negligence and willful misconduct so the exclusivity clause is enforceable in all jurisdictions.
5
Complete the data ownership and security schedule
Confirm that customer data remains the customer's property, specify the security standards the provider maintains (SOC 2 Type II, ISO 27001, or equivalent), and set the data-return or deletion timeline post-termination.
💡 If the customer is subject to GDPR, CCPA, HIPAA, or another data protection regime, execute a Data Processing Agreement (DPA) as a separate addendum before or at signing — do not try to embed DPA language in the MSA body.
6
Calibrate the liability cap and exclusions
Set the aggregate liability cap as a multiple of fees paid in the prior 12 months (1× is standard; 2× for higher-risk deployments). List the damages categories that are excluded and the exceptions — typically IP indemnity, confidentiality breach, and gross negligence.
💡 For customers handling sensitive personal data or operating in regulated industries, consider a higher cap (2–3×) or a separate sub-cap for data breach events that is not subject to the aggregate ceiling.
7
Set the auto-renewal window and termination mechanics
Choose an initial term (12 or 24 months is standard), set the auto-renewal cancellation notice window (60–90 days is typical), and define the cure period for material breach before termination for cause (30 days is customary).
💡 Mirror the cancellation notice window in both the MSA and the Order Form. Discrepancies between the two documents are one of the most common sources of renewal disputes.
8
Execute before service access is granted
Both parties must sign the MSA — and ideally the first Order Form simultaneously — before the customer is given credentials or access to the service. Post-access execution creates arguments that implied terms govern any pre-signature period.
💡 Use a timestamped eSignature platform so the execution record is indisputable. Store the fully executed MSA and all Order Forms in a single document management location accessible to both parties.