Liability caps 101: what MSPs should understand before agreeing to a number

A liability cap is the most money you can be forced to pay a client if something goes wrong under the contract. For most MSP work, a sensible cap is tied to what the client actually pays you, something like "fees paid in the 12 months before the claim." The number matters, but the carve-outs around it matter more. A $100,000 cap with "excluding data breaches" written next to it is not really a $100,000 cap.

This is general information, not legal advice. I'm telling you what to look for and what to ask your own attorney, not what any specific clause means for your business.

what a liability cap actually does

The cap sits in the limitation of liability section, usually near the bottom of the agreement in all caps or bold. It says: no matter how badly this goes, the total we can owe you is capped at X.

Two numbers show up most often:

• A multiple of fees. "Fees paid in the prior 12 months" is the common one. If the client pays you $8,000 a month, that cap is roughly $96,000.
• A fixed dollar amount. "$250,000" or "$1,000,000" regardless of what they pay you.

The fees-based cap is the one that scales with the relationship. A $2,000-a-month client and a $40,000-a-month client carry very different risk, and a fees multiple sorts that out automatically. A flat dollar cap does not. If you sign the same $1,000,000 cap with a tiny client, you've taken on big-client exposure for small-client revenue.

Watch the multiple. "Fees paid in the prior 12 months" is one year. "Two times fees paid in the prior 12 months" doubles your ceiling. "Total fees paid under the agreement" on a five-year contract could be five years of fees. Same clause structure, very different exposure.

the carve-outs are where the real risk lives

Here's the part that trips up MSPs. Right after the cap, there's almost always a list of things the cap does not apply to. Those are carve-outs, and they're uncapped unless the contract says otherwise. Every item on that list is a hole in your ceiling.

Common carve-outs you'll see:

• Breach of confidentiality
• Indemnification obligations
• Gross negligence or willful misconduct
• Breach of data protection or privacy obligations
• Infringement of intellectual property
• A party's indemnity for third-party claims

Some of those are normal and hard to push back on. Fraud and willful misconduct being uncapped is standard, and most lawyers will tell you to accept it. The one to read three times is the data or security carve-out. For an MSP, a security incident is the single most likely way a client ever comes after you. If data breaches are carved out of the cap, your cap does almost nothing for the risk you're most exposed to.

That doesn't mean you refuse every data carve-out. It means you look at whether there's a separate, higher cap for security claims instead of unlimited liability. A "super cap" might read: general liability capped at 12 months of fees, security and data claims capped at $2,000,000 or two times fees, whichever is greater. That's a far better structure than unlimited, and it's a reasonable thing to ask for.

does my cyber insurance match the number I'm agreeing to?

Put the question in plain terms: if the worst carve-out triggers, can I actually pay it? Your liability cap and your insurance limits should be in the same conversation.

If your cyber policy carries a $1,000,000 aggregate limit and you've signed three contracts with uncapped data-breach liability, you've promised more than you can cover. One bad incident, and the gap between what you owe and what insurance pays comes out of the business.

A few things to check before you agree to a number:

• The per-occurrence and aggregate limits on your cyber and E&O policies. Aggregate is the total for the whole policy year, across all clients.
• Whether the policy has sublimits for specific things like ransomware or regulatory fines that sit below the headline number.
• Whether the contract requires insurance you don't carry. Some MSA templates demand $5,000,000 in cyber coverage. If your policy is $1,000,000, that's a problem you want to find before signing, not during a claim.

Line up the cap, the carve-outs, and the insurance. If a carve-out creates exposure your policy can't absorb, that's the conversation to have with the client (and your broker) before the ink dries.

numbers I'd expect to see for a typical MSP deal

There's no legal "right" number, and your attorney and your risk tolerance drive this. But for context, here's the range I see as normal for mid-market MSP agreements:

• General cap: 12 months of fees paid, sometimes 6 months on smaller deals, sometimes 2x fees on larger ones.
• A separate, higher cap for security and data claims rather than unlimited liability.
• Fraud, willful misconduct, and a party's own indemnity obligations sitting outside the cap. That's typical and usually not worth a fight.
• Consequential and indirect damages excluded for both sides. This is the "waiver of consequential damages" clause, and it keeps lost-profits claims out of the picture. If the mutual waiver is missing, that's a bigger deal than the cap number itself.

If a client hands you a contract with a flat $500,000 cap, no fees-based alternative, data breaches carved out to unlimited, and no consequential-damages waiver, you're looking at exposure well beyond that $500,000 headline. The headline is the least informative number on the page.

the waiver of consequential damages does half the work

People obsess over the cap and skim past the consequential damages waiver. That waiver is often doing more to protect you than the cap is.

Consequential damages are the downstream losses: lost profits, lost business, lost revenue the client claims flowed from your mistake. Those numbers get big fast and they're hard to predict. A mutual waiver of consequential damages says neither side can chase the other for that category. With the waiver, your exposure is mostly the direct cost of fixing the problem. Without it, a client could argue your outage cost them a $3,000,000 contract, and your cap is the only thing standing between you and that claim.

Two things to look for:

• Is the waiver mutual? It should apply to both parties, not just protect the client.
• Are any damages pulled back into "direct damages" by definition? Some contracts define cost of cover or breach-notification costs as direct, which pulls them under the cap and outside the waiver. Worth knowing where those costs land.

quick checklist before you agree to a cap

Run through this before you sign, and hand anything that fails to your lawyer:

• Is the cap tied to fees, and over what period? Confirm whether it's 12 months, the whole term, or a multiple.
• What's on the carve-out list, and is anything on it uncapped that could sink the business?
• Is there a separate cap for data and security claims, or is that liability unlimited?
• Is there a mutual waiver of consequential and indirect damages?
• Does the required insurance match what you actually carry?
• Does the cap apply to both parties, or only limit what the client owes you?

The point isn't to win every term. Some carve-outs are standard and you'll accept them. The point is to know which number you're really agreeing to, because the bold figure in the limitation-of-liability clause is rarely the whole story.