Lessons From the CrowdStrike Outage: Reviewing and Strengthening IT Service Level Agreements and Contract Remedies

Description

On July 19, 2024, organizations throughout the world experienced serious disruptions to their operations when businesses and individuals were unable to log onto devices and accounts for prolonged periods. The technology outage was traced back to a security update pushed out by CrowdStrike, a cybersecurity company, that caused the Microsoft Windows operating system to crash.

Business losses tied to the outage are anticipated to include disrupted operations, loss of revenue, loss of business opportunities, recovery costs, legal fees, and loss of customer and investor confidence, among others. All of these can lead to contractual and indemnity issues, and many organizations are examining the possibility of contractual recourse for the CrowdStrike incident.

The IT industry commonly limits or excludes liability for indirect, consequential, and special damages in agreements. And many IT contracts also do not allow third parties to benefit from any protections between the service provider and customer. CrowdStrike's terms and conditions contained these traditional exclusions, as well as other caps on liability. As a result, many anticipate that CrowdStrike's terms and conditions will largely protect it against damages claims brought in litigation.

In response, and to mitigate or avoid the serious impacts of service disruptions like the CrowdStrike outage in the future, counsel should review and strengthen service level agreements and contractual remedies to protect clients against devastating losses tied to future IT outages.

Listen as our panel of experts discusses the implications of the CrowdStrike outage for tech-reliant businesses and provides critical insight into the contractual mechanisms that can be used to protect clients against the impacts of future IT outages and failures.