Selling a cybersecurity services firm in Canada

An owner selling a security firm has an unusual problem: documents a buyer may most want to see, such as client reports, network diagrams and findings, are ones the firm may be obliged to protect, and the engagement terms may give them to the client. The sale therefore needs careful sequencing. This page follows one order. Put the contracts and records in order, decide what a buyer sees and when, deal with the people who deliver the work, and then handle the structure and filings that closing requires.

Fix the contracts before a buyer reads them

Start with the engagement letters and master service agreements for every recurring client. Read each one for three things: how far the firm’s liability is capped, whether the contract can be assigned to a buyer or needs the client’s consent, and whether a change-of-control clause gives the client a right to terminate. Contracts that differ from client to client mean a buyer has to review each variation. Where a clause will plainly cause a problem, approach that client deliberately and early, on your terms, rather than in the final week at the buyer’s insistence. Do the same for reseller and partner agreements with tool vendors, which may carry their own consent requirements, and for subcontractor agreements, which should say who owns the work product.

Put your own incident record in order

A security firm’s own breaches are part of its history. PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control, and the Privacy Commissioner’s guidance says the records must contain information that lets the Office verify compliance with the breach reporting and notification requirements. Quebec’s privacy regime separately expects a register of confidentiality incidents. Before listing, check that the record exists, that each entry shows why the firm decided whether to report, and that anything reportable was reported.

Decide what the data room holds

Privacy law sets conditions on what a prospective buyer may receive. Under PIPEDA, parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if they have an agreement requiring the recipient to use it solely for purposes related to the transaction, to protect it with appropriate safeguards and to return or destroy it within a reasonable time if the deal does not proceed, and if the information is necessary to decide whether to proceed and, if so, to complete the transaction. That route does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. Quebec’s regime has its own rule permitting communication that is necessary to conclude a commercial transaction, on conditions the Act sets out, so have counsel check them for a Quebec client. One approach is to show client lists, contract terms and anonymized metrics first, keep live findings and credentials out entirely, and release client identities in stages as the buyer becomes serious.

Protect the people who deliver the work

Analysts are the part of the firm that can leave, so decide who is told about the sale and when, and which of them will be offered retention terms tied to closing. In Ontario, the Employment Standards Act, 2000 treats an employee’s employment with the seller as employment with the purchaser for any later calculation of length or period of employment, if the purchaser hires them, so those who stay do not restart those calculations under the Act; the Act sets a 13-week limit, counted from the employee’s last day of employment with the seller or the day of the sale, whichever is earlier (s. 9(2)). British Columbia’s Employment Standards Act has a similar rule treating employment as continuous across a sale, and Quebec’s CNESST publishes its own guidance on the sale of a company. Which rules apply depends on where each analyst works, and a team spread across provinces may sit under more than one regime.

Structure decides which filings follow

Whether the deal is a sale of shares or of assets changes the paperwork. In a share sale the corporation continues, and the CRA needs current information on changes of owners, officers and directors once the corporate registry shows them. In an asset sale the CRA says a seller with employees must close its payroll account, after remitting source deductions and filing final information returns, and, if it has a GST/HST account, must contact its tax services office to close it. The CRA also describes a joint GST/HST election with the purchaser, made on form GST44, under which no GST/HST is payable on the sale of a business, although the CRA lists supplies that are still taxed, such as taxable leases and licences; it cannot be made if only one or more assets are sold, or if a registrant sells to a purchaser that is not one. The CRA also says that, depending on your situation, you may have a recapture or a terminal loss of capital cost allowance on the sale of your assets, which is worth raising with an accountant before a price is agreed.

What can delay a close

• Client consents arriving late because the firm approached its largest accounts last, or only after the buyer asked.
• Questions about whether the firm’s professional and cyber insurance continues after the sale, which turn on the policy wording and the insurer.
• Key analysts asking for retention terms only after the letter of intent is signed.
• Gaps in the incident record found during diligence rather than before it.
• Disagreement about which party carries responsibility for work delivered before closing.