1022-00008 · Northgate Telecommunications PLC · Negotiation & Drafting

memo-indemnification-analysis.docx DOCUMENT M&A / Corporate

17 / 38 ← → ✕

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

To: Colette Whitman, Partner, Calderwood & Harkness LLP

From: Christy Bauer, Associate, Calderwood & Harkness LLP

Date: April 28, 2023

Re: Indemnification Provisions Analysis and Risk Assessment — Northgate Americas, Inc. / Cedarpoint Systems Integration, Inc. Master Services Agreement

Matter No.: 1022-00008

I. Executive Summary

The purpose of this memorandum is to analyze and assess the indemnification framework negotiated in the draft Master Services Agreement ("MSA") between Northgate Americas, Inc. ("Northgate Americas" or "Customer") and Cedarpoint Systems Integration, Inc. ("Cedarpoint" or "Service Provider"). This analysis is based on the first draft MSA circulated on April 3, 2023, as modified by Cedarpoint's redline dated April 21, 2023, and reflects the current state of negotiations between our firm and Cedarpoint's counsel, Whitfield Graves & Morrow LLP.

The MSA contemplates a total contract value ("TCV") of $75,000,000 over a five-year initial term commencing June 9, 2023 and expiring June 8, 2028. The annual contract value ("ACV") is $15,000,000, representing a monthly run-rate of approximately $1,250,000. The scope of the engagement encompasses managed WAN services, SD-WAN deployment, cybersecurity monitoring, and the migration of Northgate Americas' network infrastructure from a legacy MPLS platform operated by Greystone Halcyon Software.

Northgate Americas is a wholly owned Delaware subsidiary of Northgate Telecommunications PLC ("NTP"), the UK-headquartered publicly traded telecommunications and SaaS company listed on the London Stock Exchange under ticker NTP.L. NTP's global operations span 14 countries, and Northgate Americas serves as the contracting entity for US-based procurement activities. Cedarpoint is a Delaware corporation headquartered in Reston, Virginia, specializing in managed network infrastructure and SD-WAN deployment. Cedarpoint's proprietary ArcMesh platform (version 4.2) is licensed to Northgate Americas as embedded technology under the MSA, making the intellectual property provisions—and particularly the indemnification framework surrounding that technology—central to the risk profile of this engagement.

The indemnification provisions are among the three key negotiation pillars in this transaction, alongside the most favored nation ("MFN") pricing clause and the change of control assignment restrictions. These three areas have absorbed the majority of negotiation bandwidth since Whitfield Graves & Morrow LLP circulated its initial counterproposal on April 14, 2023, and remain the principal open items as the parties work toward execution.

This memorandum covers the following topics in detail:

(1) Cedarpoint's indemnification obligations to Northgate Americas and its affiliates;

(2) Northgate Americas' indemnification obligations to Cedarpoint;

(3) Aggregate indemnification caps and carve-outs from those caps;

(4) Procedural mechanics governing the assertion and defense of indemnification claims;

(5) Interplay between the indemnification framework and insurance requirements imposed on Cedarpoint under the MSA; and

(6) A comprehensive risk assessment, including comparison to market practice and specific recommendations for the next round of negotiations.

The MSA is governed by the laws of the State of New York, without regard to conflict of laws principles.

II. Background and Parties

A. Northgate Americas, Inc.

Northgate Americas, Inc. is a Delaware corporation and the US contracting entity for Northgate Telecommunications PLC's North American procurement activities. Its registered agent is Calvert Corporate Services, Inc., located at 1209 Orange Street, Wilmington, Delaware 19801. Northgate Americas maintains its principal office at 1700 Market Street, Suite 2400, Philadelphia, Pennsylvania 19103. Its employer identification number is 84-3291067.

The key business stakeholders at Northgate Americas and NTP for this engagement include:

• Warren Liang, President, Northgate Americas, Inc. — executive sponsor for the Cedarpoint engagement and signatory authority for the MSA;

• Katrina Bosch, Vice President of Network Operations, Northgate Americas — principal technical contact overseeing the 18-month migration from the Greystone legacy MPLS infrastructure and ongoing managed network operations;

• Deirdre Kwan, Vice President of Procurement (North America), Northgate Americas — lead commercial negotiator and owner of the vendor relationship;

• Marcus Harcourt, General Counsel, Northgate Telecommunications PLC — senior legal authority overseeing the transaction from NTP's London headquarters; and

• Alistair Pemberton, Chief Technology Officer, Northgate Telecommunications PLC — responsible for global technology strategy, including the ArcMesh platform evaluation and interoperability assessment with NTP's broader network architecture.

B. Cedarpoint Systems Integration, Inc.

Cedarpoint Systems Integration, Inc. is a Delaware corporation headquartered at 11400 Commerce Park Drive, Suite 600, Reston, Virginia 20191. Its employer identification number is 52-4178503. Cedarpoint employs approximately 1,800 individuals across its US and Canadian operations and reported fiscal year 2022 revenue of approximately $420,000,000.

The key individuals at Cedarpoint relevant to this engagement include:

• Rajiv Sundaram, Chief Executive Officer and co-founder (18% equity stake) — Cedarpoint's principal decision-maker and the driving force behind the ArcMesh platform's development;

• Teresa Cho, co-founder (12% equity stake) — responsible for Cedarpoint's enterprise sales organization and client relationship management;

• Philip Hargreaves, Chief Financial Officer — responsible for financial reporting and insurance procurement; and

• Nadia Okafor, General Counsel — Cedarpoint's in-house legal lead for the MSA negotiations, working in coordination with outside counsel at Whitfield Graves & Morrow LLP.

C. Cedarpoint's Majority Owner

Cedarpoint's majority owner is Ridgeline Capital Partners, LP, a Delaware limited partnership holding 62% of Cedarpoint's voting equity. Ridgeline Capital Partners is headquartered at 55 Arch Street, Suite 700, Greenwich, Connecticut 06830. Its Managing Partner is Jonathan Kessler. The remaining equity is held by co-founders Rajiv Sundaram (18%) and Teresa Cho (12%), with the balance distributed among other management team members and early-stage investors. Ridgeline Capital Partners acquired its controlling stake in Cedarpoint in a 2019 growth equity transaction. As discussed in Section VIII.B below, no parent guarantee or credit support from Ridgeline Capital Partners is required under the current MSA framework, which presents a potential risk consideration for uncapped indemnification obligations.

D. Counterparty Counsel

Cedarpoint is represented in this transaction by Whitfield Graves & Morrow LLP ("WGM"), located at 1875 K Street NW, Suite 800, Washington, DC 20006. The WGM deal team is led by Douglas Fenn, a partner in the firm's Technology Transactions practice, with associate Simone Alvarez providing day-to-day support. Our primary points of contact for markup exchanges and negotiation calls have been Mr. Fenn and Ms. Alvarez.

E. Our Firm

Calderwood & Harkness LLP represents Northgate Americas, Inc. in this transaction. Our office is located at 600 Lexington Avenue, 30th Floor, New York, New York 10022. Colette Whitman serves as lead partner on the engagement, and Christy Bauer serves as the primary drafting associate. Garrett Simmons of our Tax Group is developing the separate tax indemnity provisions for the MSA and is copied on this memorandum.

F. Scope of the MSA

The MSA encompasses a comprehensive suite of managed network services, including:

• Managed WAN services across 340 nodes in 28 US states and 3 Canadian provinces (British Columbia, Ontario, and Manitoba);

• SD-WAN deployment utilizing Cedarpoint's proprietary ArcMesh platform version 4.2, licensed to Northgate Americas as embedded technology under the MSA;

• 24×7 Network Operations Center ("NOC") monitoring from Cedarpoint's facilities in Reston, Virginia and Winnipeg, Manitoba;

• A phased migration from Greystone Halcyon Software's legacy MPLS infrastructure, to be executed in three phases over 18 months (Phase 1: East Coast nodes, Phase 2: Central US and Canadian nodes, Phase 3: West Coast nodes); and

• Cybersecurity monitoring, threat detection, and incident response services for the managed network perimeter.

The breadth of these services, and in particular the licensing of ArcMesh as embedded technology and the cybersecurity monitoring responsibilities, directly informs the scope and significance of the indemnification provisions analyzed in this memorandum.

III. Cedarpoint's Indemnification Obligations

Cedarpoint's indemnification obligations under the MSA are organized into four principal categories, each of which is analyzed below. These obligations collectively represent the primary risk-shifting mechanisms in favor of Northgate Americas and reflect the fundamental principle that, as the service provider and technology licensor, Cedarpoint bears primary responsibility for losses arising from the technology, personnel, and operational functions it contributes to the engagement.

A. Third-Party intellectual Property Infringement Claims

Under Section 12.1(a) of the draft MSA, Cedarpoint shall indemnify, defend, and hold harmless Northgate Americas and its affiliates (including, expressly, Northgate Telecommunications PLC and its subsidiaries worldwide) from and against any and all third-party claims, suits, actions, proceedings, demands, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to any allegation that the ArcMesh platform (version 4.2) or any component of Cedarpoint's managed network services infringes, misappropriates, or otherwise violates any third-party intellectual property right. The definition of "Intellectual property right" encompasses patents, copyrights, trade secrets, trademarks, service marks, and any other proprietary rights recognized under applicable law.

This obligation is of particular significance to Northgate Americas for several reasons. First, the ArcMesh platform is proprietary to Cedarpoint and constitutes embedded technology licensed—not sold—under the MSA. Northgate Americas has no meaningful ability to assess, monitor, or mitigate intellectual property risk in the ArcMesh platform; it must rely entirely on Cedarpoint's representations regarding the platform's freedom to operate. Second, the ArcMesh platform is deployed across all 340 network nodes, meaning that an IP infringement finding could affect the entire managed network and potentially require a migration to alternative technology, with catastrophic cost and operational implications. Third, the SD-WAN market is characterized by active patent litigation among technology vendors, and the risk of third-party patent assertions is not hypothetical—multiple SD-WAN platform providers have been targeted by patent assertion entities in recent years.

Importantly, Cedarpoint's obligation encompasses a duty to defend, not merely a duty to indemnify. This distinction is critical. A duty to defend shifts the burden of litigation management—including the selection and retention of defense counsel, the day-to-day management of litigation, and the advancement of defense costs—to the indemnifying party. By contrast, a mere duty to indemnify would require Northgate Americas to manage the defense and seek reimbursement after the fact. The duty to defend provides Northgate Americas with materially greater protection, particularly in the context of complex patent litigation where defense costs alone can reach several million dollars.

The MSA includes three standard carve-outs from Cedarpoint's IP infringement indemnification obligation:

(i) Cedarpoint shall not be liable for infringement arising from modifications to the ArcMesh platform made by Northgate Americas without Cedarpoint's prior written authorization;

(ii) Cedarpoint shall not be liable for infringement arising from the use of the ArcMesh platform in combination with non-Cedarpoint products, services, or technology where the infringement would not have arisen from the ArcMesh platform standing alone; and

(iii) Cedarpoint shall not be liable for infringement arising from Northgate Americas' use of the ArcMesh platform outside the scope of the license granted under the MSA.

These carve-outs are standard in technology licensing transactions and are reasonable in scope. They appropriately limit Cedarpoint's exposure to infringement claims that are attributable to Northgate Americas' own actions rather than to the inherent characteristics of the ArcMesh platform.

As discussed in detail in Section V.C below, the IP infringement indemnification obligation is expressly carved out from the aggregate indemnification cap. Cedarpoint's IP infringement liability under the MSA is therefore uncapped. This is the single most important indemnification provision in the MSA from Northgate Americas' perspective and should be preserved without qualification in subsequent negotiations.

B. Data Breach Indemnification

Under Section 12.1(b) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against all losses, costs, regulatory fines, penalties, and third-party claims arising from data breaches caused by Cedarpoint's negligence or willful misconduct. The scope of this obligation covers unauthorized access to, disclosure of, or loss of Northgate Americas' data while in Cedarpoint's custody or control. "Northgate Americas' data" is defined broadly to include customer data, network traffic metadata, system configuration data, authentication credentials, and personally identifiable information ("PII") of Northgate Americas employees, customers, and end users.

The data breach indemnification is particularly relevant given the nature and scope of Cedarpoint's cybersecurity responsibilities under the MSA. Cedarpoint provides 24×7 cybersecurity monitoring, threat detection, and incident response services for the managed network perimeter. Cedarpoint's NOC facilities in Reston, Virginia and Winnipeg, Manitoba serve as the primary nerve centers for network security operations, and Cedarpoint personnel have broad access to Northgate Americas' network traffic and systems. This access creates a significant data-exposure vector: if Cedarpoint's security practices are inadequate, or if its NOC facilities are compromised, the consequences for Northgate Americas—a regulated telecommunications company—could be severe, including regulatory enforcement actions, customer class-action litigation, and reputational harm.

Like the IP infringement indemnification, the data breach indemnification obligation is expressly carved out from the aggregate cap and is therefore uncapped. This reflects the potentially catastrophic scope of a network-wide data breach affecting 340 nodes across 28 US states and 3 Canadian provinces.

The data breach indemnification interacts with two other MSA exhibits. Exhibit E (Data Security and Privacy Requirements) sets forth detailed requirements for Cedarpoint's data security practices, including encryption standards, access control protocols, vulnerability management, penetration testing schedules, and breach notification procedures. Exhibit F (Insurance Requirements) mandates cyber liability insurance coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate, which provides a direct financial backstop for Cedarpoint's data breach indemnification obligations.

One important qualifier warrants attention: the data breach indemnification is triggered only by Cedarpoint's negligence or willful misconduct, not by strict liability. This is a negotiated position. Our initial draft of the MSA proposed strict liability for data breaches occurring within Cedarpoint's systems—that is, Cedarpoint would bear indemnification responsibility for any breach regardless of fault. Cedarpoint and WGM pushed back forcefully on this position during the negotiation call on April 17, 2023, arguing that strict liability for data breaches would be commercially unreasonable in light of the sophisticated and evolving threat landscape, and that no amount of due care can guarantee against all breaches. After internal consultation with Colette Whitman and discussion with Deirdre Kwan, we agreed to move to a negligence-based trigger, subject to the condition that the data breach indemnification remain carved out from the aggregate cap. The implications of this qualification are discussed in Section VIII.B below.

C. Bodily Injury and Property Damage

Under Section 12.1(c) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against third-party claims for bodily injury or tangible property damage caused by the acts or omissions of Cedarpoint personnel—including employees, contractors, and subcontractors—while performing services on Northgate Americas' premises or at Northgate Americas-designated facilities.

This is a standard provision for managed services agreements involving on-site personnel. It is particularly relevant during the 18-month migration from Greystone Network Solutions' legacy MPLS infrastructure, during which Cedarpoint technicians will be physically present at Northgate Americas' data centers and network node locations across 28 US states and 3 Canadian provinces. The migration involves physical installation and configuration of SD-WAN hardware at each of the 340 nodes, creating ongoing bodily injury and property damage exposure throughout the migration period.

Unlike the IP infringement and data breach indemnification obligations, the bodily injury and property damage indemnification is subject to the aggregate indemnification cap described in Section V below. This is consistent with market practice, as bodily injury and property damage claims in the context of technology services engagements are typically insurable and do not present the same catastrophic-loss profile as IP infringement or data breach claims.

Cedarpoint's bodily injury and property damage indemnification is supported by the CGL insurance requirement under Exhibit F, which mandates coverage of $5,000,000 per occurrence and $10,000,000 in the aggregate.

D. Regulatory Penalties

Under Section 12.1(d) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against regulatory penalties, fines, or sanctions arising from Cedarpoint's failure to comply with applicable telecommunications regulations in the performance of the managed network services.

This provision is significant given Northgate Americas' status as a subsidiary of NTP, a regulated telecommunications company. Northgate Americas' network operations are subject to regulatory oversight by the Federal Communications Commission ("FCC") and state public utility commissions in each of the 28 US states where it operates, as well as the Canadian Radio-television and Telecommunications Commission ("CRTC") and relevant provincial regulators in British Columbia, Ontario, and Manitoba. Because Cedarpoint's managed network services are integral to Northgate Americas' telecommunications infrastructure, a failure by Cedarpoint to comply with applicable regulations—for example, emergency services interconnection requirements, network reliability standards, or data privacy regulations—could expose Northgate Americas to regulatory enforcement actions and financial penalties.

The regulatory penalty indemnification is subject to the aggregate indemnification cap and is not carved out.

An important open issue relates to the causation standard for this provision. In its April 21, 2023 redline, Cedarpoint proposed modifying the indemnification trigger from "arising from Cedarpoint's failure to comply with applicable telecommunications regulations" to "arising from regulatory penalties directly and solely caused by Cedarpoint's acts or omissions." This narrowing language would significantly limit Cedarpoint's exposure by requiring Northgate Americas to demonstrate that a regulatory penalty was both "directly" and "solely" caused by Cedarpoint—excluding cases where Cedarpoint's non-compliance was a contributing cause but not the sole cause, and potentially introducing fact-intensive causation disputes. As discussed in Section IX below, we recommend resisting this narrowing language and maintaining the broader "arising from" causation standard.

IV. Northgate Americas' Indemnification Obligations

Northgate Americas' indemnification obligations under the MSA are more limited in scope than Cedarpoint's, reflecting the fundamental asymmetry of the service provider/customer relationship. Northgate Americas' obligations are organized into two principal categories.

A. Misuse of ArcMesh Platform Outside Licensed Scope

Under Section 12.2(a) of the draft MSA, Northgate Americas shall indemnify, defend, and hold harmless Cedarpoint and its affiliates from and against any third-party claims, suits, actions, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from Northgate Americas' use of the ArcMesh platform outside the scope of the license granted under the MSA.

The ArcMesh license under the MSA is limited to managed network operations across the 340 designated nodes in the United States and Canada. Any use of the ArcMesh platform beyond this scope—including, without limitation, sublicensing to third parties, use for the benefit of non-Northgate entities, reverse engineering, decompilation, or disassembly of the ArcMesh platform code—would trigger Northgate Americas' indemnification obligation.

This provision functions as a symmetry mechanism: it mirrors Cedarpoint's IP infringement indemnification obligation under Section III.A above, but applies to the converse scenario. Where Cedarpoint bears risk for IP infringement inherent in the ArcMesh platform itself, Northgate Americas bears risk for IP claims arising from its own misuse of the licensed technology. This allocation is logical and commercially reasonable. Northgate Americas controls its own use of the ArcMesh platform and is in the best position to ensure that its use remains within the licensed scope.

B. Third-Party Content Claims

Under Section 12.2(b) of the draft MSA, Northgate Americas shall indemnify Cedarpoint against third-party claims relating to Northgate Americas-provided data or content transmitted over the managed network.

This provision recognizes the fundamental principle that Cedarpoint, as the managed network services provider, does not control, monitor, or have editorial authority over the content flowing through the network. Northgate Americas and its customers, employees, and end users determine what data and content is transmitted; Cedarpoint merely provides the network infrastructure and management services that facilitate that transmission. Accordingly, Northgate Americas bears the risk of content-related claims, including but not limited to claims sounding in defamation, copyright infringement, invasion of privacy, violation of data protection laws, or breach of third-party contractual restrictions on data transmission.

This obligation interacts with Exhibit D (Acceptable Use Policy) of the MSA, which establishes the parameters for acceptable use of the managed network and imposes certain restrictions on Northgate Americas' use of the network (including prohibitions on transmission of illegal content, malware, or content that violates third-party intellectual property rights). Compliance with the Acceptable Use Policy does not, however, relieve Northgate Americas of its indemnification obligation under this section.

V. Aggregate Indemnification Caps

The MSA establishes an asymmetric cap structure that limits each party's aggregate indemnification liability, subject to express carve-outs for certain high-risk categories of claims. The cap structure is analyzed below.

A. Cedarpoint's Aggregate Cap

Cedarpoint's aggregate indemnification liability under the MSA is capped at 200% of the aggregate fees paid by Northgate Americas during the twelve-month period immediately preceding the date of the claim giving rise to the indemnification obligation.

Based on the ACV of $15,000,000, the effective cap in a stabilized year (i.e., Year 2 onward, assuming consistent fee payments) is calculated as follows:

200% × $15,000,000 = $30,000,000

The 200% multiplier reflects the significant risk profile of the engagement. Several factors contributed to the negotiation of this multiplier, including: (i) the embedded nature of the ArcMesh proprietary technology, which creates technology-dependence risk for Northgate Americas; (ii) Cedarpoint's cybersecurity monitoring and incident response obligations, which create data-exposure risk; (iii) the scale of the managed network (340 nodes across 28 US states and 3 Canadian provinces); and (iv) the criticality of the network infrastructure to Northgate Americas' core telecommunications operations.

As a benchmark, the $30,000,000 cap represents approximately 7.1% of Cedarpoint's fiscal year 2022 revenue of $420,000,000. While this is a commercially significant figure, it is not disproportionate to Cedarpoint's financial capacity and is consistent with the upper end of market practice for managed network services engagements of comparable scale and complexity (see Section VIII.C below).

One important drafting issue requires attention. The cap is structured as a trailing 12-month calculation, meaning it is based on the aggregate fees actually paid during the 12 months preceding the claim date. In the early months of Year 1, this calculation produces a materially lower effective cap. For example:

• After Month 1: 200% × $1,250,000 = $2,500,000

• After Month 3: 200% × $3,750,000 = $7,500,000

• After Month 6: 200% × $7,500,000 = $15,000,000

• After Month 12: 200% × $15,000,000 = $30,000,000

This ramp-up effect creates a window of reduced protection during the first 12 months of the MSA term—precisely when the risk of claims may be highest, given the complexity and operational disruption associated with the 18-month migration from Greystone Network Solutions' legacy MPLS infrastructure. As discussed in Section IX below, we recommend adding express language to the MSA providing that for claims arising during the first 12 months, the cap is calculated based on the annualized ACV (i.e., projected fees for 12 months) rather than actual fees paid to date.

B. Northgate Americas' Aggregate Cap

Northgate Americas' aggregate indemnification liability under the MSA is capped at 100% of the aggregate fees paid by Northgate Americas during the twelve-month period immediately preceding the date of the claim giving rise to the indemnification obligation.

Based on the ACV of $15,000,000, the effective cap in a stabilized year is:

100% × $15,000,000 = $15,000,000

The asymmetry in caps—200% for Cedarpoint versus 100% for Northgate Americas—reflects the fundamental risk allocation in the MSA. Cedarpoint, as the service provider and licensor of embedded proprietary technology, bears greater exposure to third-party claims (particularly IP infringement and data breach claims) than Northgate Americas, which is the customer and licensee. The 100% cap for Northgate Americas is consistent with median market practice for enterprise technology services agreements of this scale, and Cedarpoint did not challenge the asymmetric structure in its April 21 redline.

The same trailing 12-month calculation issue described above in connection with Cedarpoint's cap also applies to Northgate Americas' cap. For consistency, any annualized calculation provision added for Cedarpoint's cap should also apply to Northgate Americas' cap.

C. Carve-Outs from Aggregate Caps (Uncapped Obligations)

The following categories of indemnification are expressly carved out from the aggregate caps and are therefore subject to uncapped liability:

1. Intellectual Property Infringement. Cedarpoint's obligation to indemnify, defend, and hold harmless Northgate Americas against third-party IP infringement claims under Section 12.1(a) of the MSA (as described in Section III.A above) is uncapped. This carve-out is critical given Northgate Americas' inability to independently assess or mitigate intellectual property risk in the ArcMesh platform, and the potentially catastrophic consequences of an IP infringement finding that could require removal or replacement of the ArcMesh technology across all 340 network nodes.

2. Willful Misconduct. Indemnification obligations arising from the willful misconduct of either party are uncapped. This is a standard carve-out reflecting the well-established public policy principle that a party should not be permitted to cap its liability for intentional wrongdoing. Under New York law, provisions purporting to limit liability for willful misconduct are generally unenforceable, making this carve-out both commercially appropriate and legally prudent.

3. Data Breach. Cedarpoint's obligation to indemnify Northgate Americas against data breaches caused by Cedarpoint's negligence or willful misconduct under Section 12.1(b) of the MSA (as described in Section III.B above) is uncapped. This carve-out reflects the potentially catastrophic scope of a network-wide data breach affecting Northgate Americas' 340-node managed network, which could give rise to regulatory fines across multiple US and Canadian jurisdictions, class-action litigation by affected individuals, contractual liability to Northgate Americas' customers, and severe reputational harm.

4. Confidentiality Breach. Indemnification obligations arising from either party's unauthorized disclosure of confidential information exchanged under the MSA are uncapped. This carve-out protects against the unauthorized disclosure of trade secrets, proprietary technology specifications, business plans, financial data, and other confidential information shared between the parties under the MSA and the predecessor Mutual Non-Disclosure Agreement dated February 22, 2023.

These four carve-outs represent Northgate Americas' key negotiated protections within the indemnification framework. They ensure that Cedarpoint's aggregate cap does not shield it from liability in the categories of claims that present the greatest potential exposure to Northgate Americas. As discussed in Section IX below, these carve-outs should not be conceded in further negotiations with WGM.

VI. Procedural Mechanics for Indemnification Claims

The MSA establishes detailed procedural requirements governing the assertion, defense, and resolution of indemnification claims. These mechanics are set forth in Section 12.3 of the draft MSA and are summarized and analyzed below.

A. Notice Requirements

The indemnified party must provide prompt written notice to the indemnifying party of any third-party claim for which indemnification is sought under the MSA. The notice must include reasonable detail of the claim, including:

(i) the nature and basis of the third-party claim;

(ii) the amount of damages or other relief sought (if known or reasonably ascertainable);

(iii) the identity of the third-party claimant; and

(iv) copies of all relevant correspondence, pleadings, subpoenas, or other filings received by the indemnified party in connection with the claim.

The MSA provides that a failure to provide timely notice does not relieve the indemnifying party of its indemnification obligation, except to the extent the indemnifying party is materially prejudiced by the delay. This standard is consistent with New York law and market practice. It protects the indemnified party against forfeiture of its indemnification rights due to inadvertent delay, while preserving the indemnifying party's right to assert a prejudice-based defense in cases where the delay has caused actual harm (e.g., the loss of an early settlement opportunity or the destruction of evidence).

B. Defense and Control of Proceedings

The indemnifying party has the right, but not the obligation, to assume control of the defense of any third-party claim for which indemnification is sought. To exercise this right, the indemnifying party must deliver written notice to the indemnified party within a reasonable period after receiving the indemnification notice.

The indemnifying party's right to control the defense is subject to the following conditions, each of which is designed to protect the indemnified party's interests:

(i) The indemnifying party must retain defense counsel that is reasonably satisfactory to the indemnified party. This requirement ensures that the indemnified party has confidence in the competence and qualifications of the counsel managing the defense;

(ii) The indemnifying party may not settle any third-party claim without the indemnified party's prior written consent if the proposed settlement involves an admission of liability on the part of the indemnified party, the imposition of injunctive or other equitable relief against the indemnified party, or any non-monetary terms or conditions affecting the indemnified party's business operations; and

(iii) The indemnified party retains the right to participate in the defense at its own expense with counsel of its choice, even when the indemnifying party has assumed control. This participation right is non-exclusive—it does not displace the indemnifying party's control of the defense but ensures the indemnified party can monitor proceedings and protect its interests.

If the indemnifying party does not assume control of the defense within thirty (30) days of receiving notice of the claim, the indemnified party may assume control of the defense and seek reimbursement of all defense costs and expenses from the indemnifying party. This 30-day deadline creates a clear trigger point and prevents indefinite delay in the organization of a defense.

C. Cooperation. Both parties are required to reasonably cooperate in connection with any indemnified claim. The cooperation obligation includes providing timely access to relevant records, documents, personnel, and information reasonably necessary for the defense or prosecution of the claim. The costs of compliance with the cooperation obligation are borne by the indemnifying party, which is appropriate given that the indemnifying party bears the economic burden of the claim and benefits from the indemnified party's cooperation.

D. Mitigation. Both parties have a duty to take commercially reasonable steps to mitigate damages in connection with any indemnified claim. This duty is consistent with the general mitigation principle under New York contract law and prevents an indemnified party from passively allowing damages to accumulate when reasonable steps could limit the harm. The "commercially reasonable" standard provides appropriate flexibility, ensuring that the mitigation obligation does not require the indemnified party to incur disproportionate costs or take actions that would materially disrupt its business operations.

VII. Insurance Requirements — Interplay with Indemnification

A. Required Coverage

The MSA, through Exhibit F (Insurance Requirements), requires Cedarpoint to maintain the following minimum insurance coverage throughout the initial term and any renewal periods:

These coverage levels were negotiated based on the total contract value, the scope of Cedarpoint's cybersecurity responsibilities, the geographic breadth of the managed network, and the embedded nature of the ArcMesh technology. The insurance requirements serve as a financial backstop for Cedarpoint's indemnification obligations, ensuring that Cedarpoint's contractual commitments are supported by the claims-paying capacity of a creditworthy insurance carrier.

B. Current Carrier

Cedarpoint's current insurance carrier for the cyber liability and technology errors and omissions policies is Braeburn Mutual Insurance Company, headquartered at 280 Farmington Avenue, Hartford, Connecticut 06105. Braeburn Mutual is a well-established specialty insurer in the technology and cyber liability markets. Certificates of insurance evidencing the required coverage and naming Northgate Americas, Inc. as an additional insured are to be delivered as a closing deliverable prior to the MSA effective date.

C. Analysis of Coverage Adequacy Relative to Indemnification Exposure

The adequacy of Cedarpoint's insurance coverage must be assessed in relation to both its capped and uncapped indemnification obligations.

Capped obligations. Cedarpoint's aggregate indemnification cap of 200% of trailing 12-month fees ($30,000,000 in a stabilized year) is well within the coverage limits of the required insurance policies. The cyber liability coverage ($25,000,000 per occurrence / $50,000,000 aggregate) provides substantial backing for data breach indemnification obligations. The technology E&O coverage ($20,000,000 per occurrence / $40,000,000 aggregate) covers errors, omissions, and failures in the delivery of managed network services and the performance of the ArcMesh platform. The CGL coverage ($5,000,000 per occurrence / $10,000,000 aggregate) covers bodily injury and property damage claims arising from Cedarpoint personnel on Northgate Americas' premises. In total, the aggregate insurance limits across the three policy types sum to $100,000,000, providing a meaningful financial cushion above the $30,000,000 indemnification cap.

Uncapped obligations. The four carve-outs from the aggregate cap—IP infringement, willful misconduct, data breach, and confidentiality breach—present residual risk beyond the insurance limits. A catastrophic IP infringement judgment, for example, could theoretically exceed the combined insurance limits, particularly if the judgment includes injunctive relief requiring a technology migration. Similarly, a willful misconduct carve-out, by definition, may not be covered by insurance policies that typically exclude intentional acts from coverage.

However, the $100,000,000 in aggregate insurance limits provides a meaningful backstop even for uncapped claims. In practice, most indemnification claims in technology services engagements are resolved within the insurance limits, and the uncapped carve-outs serve primarily as a risk-allocation mechanism and deterrent rather than as a frequently invoked recovery path.

Recommendation. We recommend including the following provisions in the MSA to strengthen the insurance-indemnification interplay:

(i) An express requirement that Cedarpoint maintain the required coverage throughout the MSA term and any renewal periods, without reduction, cancellation, or material modification;

(ii) A requirement that any material reduction in coverage, change of carrier, or cancellation of any required policy triggers a 30-day advance written notice obligation to Northgate Americas, providing the Customer with an opportunity to assess the impact and, if necessary, exercise remedial rights under the MSA; and

(iii) Confirmation of Braeburn Mutual Insurance Company's current financial strength ratings and financial stability through Northgate Americas' risk management team, to ensure that the insurance backstop is supported by a carrier with adequate claims-paying capacity.

D. Additional Insured and Subrogation Waivers

The MSA requires that Northgate Americas, Inc. and Northgate Telecommunications PLC be named as additional insureds on all required insurance policies. The additional insured endorsement provides Northgate Americas and NTP with direct rights under the policies, enabling them to access insurance proceeds without relying solely on Cedarpoint's cooperation. This is particularly important in the event that Cedarpoint becomes insolvent, uncooperative, or unable to manage a claim.

The MSA further requires a waiver of subrogation in favor of Northgate Americas and NTP on all required policies. The subrogation waiver prevents Cedarpoint's insurance carrier from pursuing recovery against Northgate Americas or NTP after paying a claim on Cedarpoint's behalf. Without the waiver, the carrier could theoretically assert subrogation rights against Northgate Americas if the carrier determined that Northgate Americas' actions contributed to the loss—a result that would undermine the indemnification framework.

Together, the additional insured endorsement and subrogation waiver reinforce the indemnification framework by providing Northgate Americas with direct recourse to insurance proceeds and eliminating the risk of carrier-initiated recovery actions.

VIII. Risk Assessment

A. Strengths of the Current Indemnification Framework

The indemnification framework negotiated in the MSA provides Northgate Americas with several significant protections:

1. Asymmetric caps favor Northgate Americas. The 200% cap on Cedarpoint's aggregate indemnification liability versus the 100% cap on Northgate Americas' liability reflects the appropriate allocation of risk in a service provider/technology licensor relationship. Cedarpoint, as the party contributing proprietary technology, cybersecurity services, and on-site personnel, bears the greater indemnification burden. This asymmetry was a key negotiation objective and has been preserved through the April 21 redline.

2. Broad uncapped carve-outs. The four uncapped carve-outs—IP infringement, willful misconduct, data breach, and confidentiality breach—protect Northgate Americas against the most significant risk categories in the engagement. These carve-outs ensure that the aggregate cap does not function as a ceiling on Cedarpoint's liability in precisely the scenarios where Northgate Americas' exposure is greatest.

3. Duty to defend for IP infringement. Cedarpoint's obligation to defend, not merely indemnify, against IP infringement claims shifts the burden of litigation management, counsel selection, and cost advancement to Cedarpoint. This is a materially stronger protection than a simple indemnification obligation and is particularly valuable in the context of complex patent litigation.

4. Strong insurance backstop. The $100,000,000 in aggregate insurance limits across three policy types, with Braeburn Mutual Insurance Company as the underwriting carrier, provides a substantial financial backstop for Cedarpoint's indemnification obligations. The insurance requirements ensure that Cedarpoint's contractual commitments are supported by institutional capital, reducing the risk of uncollectible indemnification claims.

5. Regulatory penalty indemnification. The inclusion of regulatory penalty indemnification—rare in many technology services agreements—recognizes the unique risk profile of this engagement, in which Cedarpoint's managed network services are integral to Northgate Americas' operations as a regulated telecommunications company. This provision ensures that Cedarpoint bears the financial consequences of its own regulatory non-compliance.

B. Residual Risks and Concerns

Notwithstanding the strengths identified above, the indemnification framework presents several residual risks and open issues that warrant attention:

1. First-year cap calculation ambiguity. As discussed in Section V.A above, the trailing 12-month cap calculation produces a materially lower effective cap during the first 12 months of the MSA term. If applied literally, Cedarpoint's effective cap after Month 3 would be only $7,500,000 (200% × $3,750,000), rather than the intended $30,000,000 cap. This gap is particularly concerning because the first 12 months coincide with the most complex and risk-intensive phase of the engagement—the migration from Greystone Network Solutions' legacy MPLS infrastructure. We recommend adding express language to the MSA specifying that for claims arising during the first 12 months, the cap is calculated based on the annualized ACV of $15,000,000 rather than actual fees paid to date.

2. Negligence qualifier on data breach indemnification. The data breach indemnification under Section 12.1(b) requires a showing of Cedarpoint's negligence or willful misconduct as a trigger. This qualifier creates a potential gap: a data breach caused by a sophisticated third-party cyberattack exploiting a zero-day vulnerability—without any negligence on Cedarpoint's part—would arguably fall outside the scope of Cedarpoint's indemnification obligation. In such a scenario, Northgate Americas would bear the financial consequences of the breach even though the breach occurred within Cedarpoint's systems and facilities. This gap should be evaluated in the context of the broader risk mitigation framework, including SLA credits under the MSA's service level agreement (Exhibit C), cyber liability insurance coverage under Exhibit F, and the contractual requirement for Cedarpoint to maintain industry-standard security practices under Exhibit E. It remains an open question whether these complementary protections adequately address the residual exposure, or whether a broader data breach trigger should be proposed in the next round of negotiations.

3. Cedarpoint's financial capacity beyond insurance. While Cedarpoint's FY2022 revenue of $420,000,000 suggests a substantial enterprise, Northgate Americas has not conducted financial diligence on Cedarpoint's balance sheet, liquidity, or ability to satisfy uncapped indemnification obligations (particularly a catastrophic IP infringement judgment that could exceed insurance limits). Ridgeline Capital Partners' 62% ownership stake may provide additional financial support in extremis, but no parent guarantee, letter of credit, or other credit support from Ridgeline is required under the current MSA framework. We recommend that Northgate Americas' finance team, through the Dunmore & Pratt LLP audit engagement led by Helen Treadway, review Cedarpoint's most recent audited financial statements to confirm balance sheet adequacy.

4. Subcontractor liability. The MSA should expressly confirm that Cedarpoint's indemnification obligations extend to the acts and omissions of Cedarpoint's subcontractors. Cedarpoint is expected to utilize subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure, and potentially on an ongoing basis for specialized services at certain network node locations. If Cedarpoint's indemnification obligations do not expressly cover subcontractor conduct, a claim arising from a subcontractor's negligence could fall into a gap—Cedarpoint might argue that its indemnification applies only to its own employees, while the subcontractor is not a party to the MSA and therefore owes no direct indemnification to Northgate Americas.

5. Regulatory penalty narrowing language. As noted in Section III.D above, Cedarpoint's April 21 redline proposed limiting the regulatory penalty indemnification to penalties "directly and solely caused by Cedarpoint's acts or omissions." This narrowing language would significantly reduce the practical scope of the provision. The "directly and solely" standard would require Northgate Americas to demonstrate that (a) Cedarpoint's conduct was the direct (not indirect or contributing) cause of the penalty, and (b) Cedarpoint's conduct was the sole cause, with no contributing fault by Northgate Americas or any third party. In practice, regulatory penalties often arise from complex factual circumstances involving multiple contributing factors, making the "solely" requirement particularly problematic. We recommend maintaining the broader "arising from" causation standard.

C. Comparison to Market Practice

The indemnification framework in the MSA is generally consistent with, and in several respects more favorable than, market practice for enterprise managed network services agreements of comparable scale and complexity. The following benchmarks are based on our firm's experience in recent comparable transactions:

• Service provider cap (200% of trailing 12-month fees): This is at the upper end of the market range for managed services engagements. Typical caps in transactions of this scale range from 100% to 200% of trailing 12-month fees, with the median at approximately 150%. The 200% cap reflects the higher risk profile of this engagement due to the embedded ArcMesh technology and cybersecurity obligations.

• Customer cap (100% of trailing 12-month fees): This is at the median of market practice for customer indemnification caps in enterprise technology services agreements.

• Uncapped carve-outs for IP infringement and data breach: These carve-outs are market standard for technology transactions involving proprietary embedded technology and cybersecurity services. Most comparable agreements include uncapped carve-outs for at least IP infringement and willful misconduct; the inclusion of data breach and confidentiality breach as additional carve-outs is a favorable feature of this framework.

• Insurance minimums ($25M cyber, $20M E&O, $5M CGL): These coverage levels are consistent with market practice for managed services engagements of comparable scale and complexity. Some recent transactions have required higher cyber liability limits (up to $50M per occurrence), but the $25M per occurrence level negotiated here is within the standard range.

IX. Recommendations

Based on the analysis set forth above, we recommend the following actions in preparation for the next round of negotiations with Whitfield Graves & Morrow LLP and the circulation of the second draft MSA, currently targeted for May 5, 2023:

1. Confirm annualized cap calculation for first 12 months. Add express language to Section 12.4 of the MSA providing that, for claims arising during the first 12 months of the initial term, each party's aggregate indemnification cap shall be calculated based on the annualized annual contract value (i.e., $15,000,000 for Northgate Americas' fee obligations) rather than the aggregate fees actually paid during the preceding 12-month period. This eliminates the ramp-up gap that would otherwise reduce Cedarpoint's effective cap during the most risk-intensive phase of the engagement.

2. Resist Cedarpoint's narrowing of regulatory penalty indemnification. Maintain the "arising from" causation standard in Section 12.1(d) and reject Cedarpoint's proposed "directly and solely caused by" formulation. The narrowing language would introduce an unworkably high burden of proof and would effectively nullify the regulatory penalty indemnification in many realistic scenarios involving contributing causes. If Cedarpoint presses this point, a potential compromise would be to accept "arising from Cedarpoint's material failure to comply with applicable telecommunications regulations" (adding a materiality qualifier) while rejecting the "directly and solely" causation standard.

3. Confirm subcontractor coverage. Ensure that Cedarpoint's indemnification obligations under Section 12.1 expressly cover the acts and omissions of Cedarpoint's employees, agents, contractors, and subcontractors. This is particularly important given Cedarpoint's anticipated use of subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure. Proposed language: "Cedarpoint's indemnification obligations under this Section 12.1 shall apply to claims arising from the acts or omissions of Cedarpoint's employees, agents, contractors, and subcontractors to the same extent as if such acts or omissions were performed by Cedarpoint directly."

4. Evaluate data breach causation gap. Schedule a discussion with Colette Whitman and the Northgate Americas client team (Deirdre Kwan and Katrina Bosch) to evaluate whether to propose a broader data breach trigger in the next draft. Options include: (a) strict liability for any breach occurring within Cedarpoint's systems regardless of fault (our original position, which was previously rejected by Cedarpoint); (b) a rebuttable presumption of negligence for any breach occurring within Cedarpoint's systems, shifting the burden to Cedarpoint to demonstrate that it complied with all applicable security standards; or (c) maintaining the current negligence standard while strengthening the complementary protections under Exhibit C (SLA credits), Exhibit E (Data Security Requirements), and Exhibit F (Insurance Requirements). This decision should be informed by Northgate Americas' risk tolerance and the relative importance of this issue in the broader negotiation context.

5. Require advance notice of insurance changes. Add a provision to Exhibit F requiring Cedarpoint to provide 30 days' advance written notice to Northgate Americas of any material reduction in coverage, change of carrier, or cancellation of any required insurance policy. This notice requirement ensures that Northgate Americas has an opportunity to assess the impact of any change in the insurance backstop and, if necessary, exercise remedial rights under the MSA (including, potentially, a right to terminate for material breach if adequate replacement coverage is not obtained).

6. Financial diligence on Cedarpoint. Given the uncapped carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach, we recommend that Northgate Americas' finance team—through the Dunmore & Pratt LLP audit engagement led by Helen Treadway—obtain and review Cedarpoint's most recent audited financial statements. The review should focus on Cedarpoint's balance sheet, liquidity position, debt obligations, and overall financial capacity to satisfy uncapped indemnification obligations that could exceed the insurance limits. If the financial review reveals concerns about Cedarpoint's capacity, we should consider whether to require a parent guarantee or other credit support from Ridgeline Capital Partners, LP.

7. Coordinate with Garrett Simmons on tax indemnity. Confirm that the general indemnification framework under Section 12 does not conflict with or duplicate the specific tax indemnity provisions being developed separately by Garrett Simmons for the MSA. The tax indemnity provisions are expected to address sales and use tax obligations, withholding tax requirements, and cross-border tax obligations arising from Cedarpoint's operations in the three Canadian provinces (British Columbia, Ontario, and Manitoba). The general indemnification framework should include a cross-reference to the tax indemnity provisions to avoid ambiguity regarding which section governs tax-related claims.

8. Preserve all four uncapped carve-outs. The carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach represent the core risk-allocation protections in the indemnification framework. These carve-outs should not be conceded or narrowed in further negotiations with Whitfield Graves & Morrow LLP. If WGM proposes caps or sub-limits on any of the carved-out categories, we should respond that these carve-outs are non-negotiable and fundamental to Northgate Americas' willingness to enter into the MSA.

X. Conclusion

The indemnification framework in the draft MSA provides Northgate Americas with robust protections that are commensurate with the $75,000,000 total contract value, the embedded ArcMesh technology licensing component, and the cybersecurity risk profile of a 340-node managed network spanning 28 US states and 3 Canadian provinces. The asymmetric cap structure—200% of trailing 12-month fees for Cedarpoint versus 100% for Northgate Americas—combined with uncapped carve-outs for the highest-risk categories (IP infringement, willful misconduct, data breach, and confidentiality breach) and substantial insurance requirements from Braeburn Mutual Insurance Company, represents a favorable risk allocation for Northgate Americas that is at or above market practice for managed services engagements of comparable scale and complexity.

The open issues identified in this memorandum—first-year cap calculation ambiguity, the regulatory penalty causation standard, the data breach negligence qualifier, and subcontractor coverage—are all addressable through targeted drafting revisions in the second draft MSA, currently scheduled for circulation on May 5, 2023. None of these issues presents a structural deficiency in the indemnification framework; rather, they represent opportunities to strengthen and clarify provisions that are already substantially favorable to Northgate Americas.

I am happy to discuss this analysis at your convenience and am available to present the findings to Marcus Harcourt and Deirdre Kwan if that would be helpful in advance of the next negotiation session with Whitfield Graves & Morrow LLP.

cc: Garrett Simmons, Calderwood & Harkness LLP

Enclosures: None

References: MSA first draft dated April 3, 2023; Cedarpoint redline dated April 21, 2023

Coverage Type	Per Occurrence	Aggregate
Cyber Liability Insurance	$25,000,000	$50,000,000
Technology Errors and Omissions Insurance	$20,000,000	$40,000,000
Commercial General Liability Insurance	$5,000,000	$10,000,000

MEMORANDUM
PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
To: Colette Whitman, Partner, Calderwood & Harkness LLP
From: Christy Bauer, Associate, Calderwood & Harkness LLP
Date: April 28, 2023
Re: Indemnification Provisions Analysis and Risk Assessment — Northgate Americas, Inc. / Cedarpoint Systems Integration, Inc. Master Services Agreement
Matter No.: 1022-00008
I. Executive Summary
The purpose of this memorandum is to analyze and assess the indemnification framework negotiated in the draft Master Services Agreement ("MSA") between Northgate Americas, Inc. ("Northgate Americas" or "Customer") and Cedarpoint Systems Integration, Inc. ("Cedarpoint" or "Service Provider"). This analysis is based on the first draft MSA circulated on April 3, 2023, as modified by Cedarpoint's redline dated April 21, 2023, and reflects the current state of negotiations between our firm and Cedarpoint's counsel, Whitfield Graves & Morrow LLP.
The MSA contemplates a total contract value ("TCV") of $75,000,000 over a five-year initial term commencing June 9, 2023 and expiring June 8, 2028. The annual contract value ("ACV") is $15,000,000, representing a monthly run-rate of approximately $1,250,000. The scope of the engagement encompasses managed WAN services, SD-WAN deployment, cybersecurity monitoring, and the migration of Northgate Americas' network infrastructure from a legacy MPLS platform operated by Greystone Halcyon Software.
Northgate Americas is a wholly owned Delaware subsidiary of Northgate Telecommunications PLC ("NTP"), the UK-headquartered publicly traded telecommunications and SaaS company listed on the London Stock Exchange under ticker NTP.L. NTP's global operations span 14 countries, and Northgate Americas serves as the contracting entity for US-based procurement activities. Cedarpoint is a Delaware corporation headquartered in Reston, Virginia, specializing in managed network infrastructure and SD-WAN deployment. Cedarpoint's proprietary ArcMesh platform (version 4.2) is licensed to Northgate Americas as embedded technology under the MSA, making the intellectual property provisions—and particularly the indemnification framework surrounding that technology—central to the risk profile of this engagement.
The indemnification provisions are among the three key negotiation pillars in this transaction, alongside the most favored nation ("MFN") pricing clause and the change of control assignment restrictions. These three areas have absorbed the majority of negotiation bandwidth since Whitfield Graves & Morrow LLP circulated its initial counterproposal on April 14, 2023, and remain the principal open items as the parties work toward execution.
This memorandum covers the following topics in detail:
(1) Cedarpoint's indemnification obligations to Northgate Americas and its affiliates;
(2) Northgate Americas' indemnification obligations to Cedarpoint;
(3) Aggregate indemnification caps and carve-outs from those caps;
(4) Procedural mechanics governing the assertion and defense of indemnification claims;
(5) Interplay between the indemnification framework and insurance requirements imposed on Cedarpoint under the MSA; and
(6) A comprehensive risk assessment, including comparison to market practice and specific recommendations for the next round of negotiations.
The MSA is governed by the laws of the State of New York, without regard to conflict of laws principles.
II. Background and Parties
A. Northgate Americas, Inc.
Northgate Americas, Inc. is a Delaware corporation and the US contracting entity for Northgate Telecommunications PLC's North American procurement activities. Its registered agent is Calvert Corporate Services, Inc., located at 1209 Orange Street, Wilmington, Delaware 19801. Northgate Americas maintains its principal office at 1700 Market Street, Suite 2400, Philadelphia, Pennsylvania 19103. Its employer identification number is 84-3291067.
The key business stakeholders at Northgate Americas and NTP for this engagement include:
•  Warren Liang, President, Northgate Americas, Inc. — executive sponsor for the Cedarpoint engagement and signatory authority for the MSA;
•  Katrina Bosch, Vice President of Network Operations, Northgate Americas — principal technical contact overseeing the 18-month migration from the Greystone legacy MPLS infrastructure and ongoing managed network operations;
•  Deirdre Kwan, Vice President of Procurement (North America), Northgate Americas — lead commercial negotiator and owner of the vendor relationship;
•  Marcus Harcourt, General Counsel, Northgate Telecommunications PLC — senior legal authority overseeing the transaction from NTP's London headquarters; and
•  Alistair Pemberton, Chief Technology Officer, Northgate Telecommunications PLC — responsible for global technology strategy, including the ArcMesh platform evaluation and interoperability assessment with NTP's broader network architecture.
B. Cedarpoint Systems Integration, Inc.
Cedarpoint Systems Integration, Inc. is a Delaware corporation headquartered at 11400 Commerce Park Drive, Suite 600, Reston, Virginia 20191. Its employer identification number is 52-4178503. Cedarpoint employs approximately 1,800 individuals across its US and Canadian operations and reported fiscal year 2022 revenue of approximately $420,000,000.
The key individuals at Cedarpoint relevant to this engagement include:
•  Rajiv Sundaram, Chief Executive Officer and co-founder (18% equity stake) — Cedarpoint's principal decision-maker and the driving force behind the ArcMesh platform's development;
•  Teresa Cho, co-founder (12% equity stake) — responsible for Cedarpoint's enterprise sales organization and client relationship management;
•  Philip Hargreaves, Chief Financial Officer — responsible for financial reporting and insurance procurement; and
•  Nadia Okafor, General Counsel — Cedarpoint's in-house legal lead for the MSA negotiations, working in coordination with outside counsel at Whitfield Graves & Morrow LLP.
C. Cedarpoint's Majority Owner
Cedarpoint's majority owner is Ridgeline Capital Partners, LP, a Delaware limited partnership holding 62% of Cedarpoint's voting equity. Ridgeline Capital Partners is headquartered at 55 Arch Street, Suite 700, Greenwich, Connecticut 06830. Its Managing Partner is Jonathan Kessler. The remaining equity is held by co-founders Rajiv Sundaram (18%) and Teresa Cho (12%), with the balance distributed among other management team members and early-stage investors. Ridgeline Capital Partners acquired its controlling stake in Cedarpoint in a 2019 growth equity transaction. As discussed in Section VIII.B below, no parent guarantee or credit support from Ridgeline Capital Partners is required under the current MSA framework, which presents a potential risk consideration for uncapped indemnification obligations.
D. Counterparty Counsel
Cedarpoint is represented in this transaction by Whitfield Graves & Morrow LLP ("WGM"), located at 1875 K Street NW, Suite 800, Washington, DC 20006. The WGM deal team is led by Douglas Fenn, a partner in the firm's Technology Transactions practice, with associate Simone Alvarez providing day-to-day support. Our primary points of contact for markup exchanges and negotiation calls have been Mr. Fenn and Ms. Alvarez.
E. Our Firm
Calderwood & Harkness LLP represents Northgate Americas, Inc. in this transaction. Our office is located at 600 Lexington Avenue, 30th Floor, New York, New York 10022. Colette Whitman serves as lead partner on the engagement, and Christy Bauer serves as the primary drafting associate. Garrett Simmons of our Tax Group is developing the separate tax indemnity provisions for the MSA and is copied on this memorandum.
F. Scope of the MSA
The MSA encompasses a comprehensive suite of managed network services, including:
•  Managed WAN services across 340 nodes in 28 US states and 3 Canadian provinces (British Columbia, Ontario, and Manitoba);
•  SD-WAN deployment utilizing Cedarpoint's proprietary ArcMesh platform version 4.2, licensed to Northgate Americas as embedded technology under the MSA;
•  24×7 Network Operations Center ("NOC") monitoring from Cedarpoint's facilities in Reston, Virginia and Winnipeg, Manitoba;
•  A phased migration from Greystone Halcyon Software's legacy MPLS infrastructure, to be executed in three phases over 18 months (Phase 1: East Coast nodes, Phase 2: Central US and Canadian nodes, Phase 3: West Coast nodes); and
•  Cybersecurity monitoring, threat detection, and incident response services for the managed network perimeter.
The breadth of these services, and in particular the licensing of ArcMesh as embedded technology and the cybersecurity monitoring responsibilities, directly informs the scope and significance of the indemnification provisions analyzed in this memorandum.
III. Cedarpoint's Indemnification Obligations
Cedarpoint's indemnification obligations under the MSA are organized into four principal categories, each of which is analyzed below. These obligations collectively represent the primary risk-shifting mechanisms in favor of Northgate Americas and reflect the fundamental principle that, as the service provider and technology licensor, Cedarpoint bears primary responsibility for losses arising from the technology, personnel, and operational functions it contributes to the engagement.
A. Third-Party intellectual Property Infringement Claims
Under Section 12.1(a) of the draft MSA, Cedarpoint shall indemnify, defend, and hold harmless Northgate Americas and its affiliates (including, expressly, Northgate Telecommunications PLC and its subsidiaries worldwide) from and against any and all third-party claims, suits, actions, proceedings, demands, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to any allegation that the ArcMesh platform (version 4.2) or any component of Cedarpoint's managed network services infringes, misappropriates, or otherwise violates any third-party intellectual property right. The definition of "Intellectual property right" encompasses patents, copyrights, trade secrets, trademarks, service marks, and any other proprietary rights recognized under applicable law.
This obligation is of particular significance to Northgate Americas for several reasons. First, the ArcMesh platform is proprietary to Cedarpoint and constitutes embedded technology licensed—not sold—under the MSA. Northgate Americas has no meaningful ability to assess, monitor, or mitigate intellectual property risk in the ArcMesh platform; it must rely entirely on Cedarpoint's representations regarding the platform's freedom to operate. Second, the ArcMesh platform is deployed across all 340 network nodes, meaning that an IP infringement finding could affect the entire managed network and potentially require a migration to alternative technology, with catastrophic cost and operational implications. Third, the SD-WAN market is characterized by active patent litigation among technology vendors, and the risk of third-party patent assertions is not hypothetical—multiple SD-WAN platform providers have been targeted by patent assertion entities in recent years.
Importantly, Cedarpoint's obligation encompasses a duty to defend, not merely a duty to indemnify. This distinction is critical. A duty to defend shifts the burden of litigation management—including the selection and retention of defense counsel, the day-to-day management of litigation, and the advancement of defense costs—to the indemnifying party. By contrast, a mere duty to indemnify would require Northgate Americas to manage the defense and seek reimbursement after the fact. The duty to defend provides Northgate Americas with materially greater protection, particularly in the context of complex patent litigation where defense costs alone can reach several million dollars.
The MSA includes three standard carve-outs from Cedarpoint's IP infringement indemnification obligation:
(i) Cedarpoint shall not be liable for infringement arising from modifications to the ArcMesh platform made by Northgate Americas without Cedarpoint's prior written authorization;
(ii) Cedarpoint shall not be liable for infringement arising from the use of the ArcMesh platform in combination with non-Cedarpoint products, services, or technology where the infringement would not have arisen from the ArcMesh platform standing alone; and
(iii) Cedarpoint shall not be liable for infringement arising from Northgate Americas' use of the ArcMesh platform outside the scope of the license granted under the MSA.
These carve-outs are standard in technology licensing transactions and are reasonable in scope. They appropriately limit Cedarpoint's exposure to infringement claims that are attributable to Northgate Americas' own actions rather than to the inherent characteristics of the ArcMesh platform.
As discussed in detail in Section V.C below, the IP infringement indemnification obligation is expressly carved out from the aggregate indemnification cap. Cedarpoint's IP infringement liability under the MSA is therefore uncapped. This is the single most important indemnification provision in the MSA from Northgate Americas' perspective and should be preserved without qualification in subsequent negotiations.
B. Data Breach Indemnification
Under Section 12.1(b) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against all losses, costs, regulatory fines, penalties, and third-party claims arising from data breaches caused by Cedarpoint's negligence or willful misconduct. The scope of this obligation covers unauthorized access to, disclosure of, or loss of Northgate Americas' data while in Cedarpoint's custody or control. "Northgate Americas' data" is defined broadly to include customer data, network traffic metadata, system configuration data, authentication credentials, and personally identifiable information ("PII") of Northgate Americas employees, customers, and end users.
The data breach indemnification is particularly relevant given the nature and scope of Cedarpoint's cybersecurity responsibilities under the MSA. Cedarpoint provides 24×7 cybersecurity monitoring, threat detection, and incident response services for the managed network perimeter. Cedarpoint's NOC facilities in Reston, Virginia and Winnipeg, Manitoba serve as the primary nerve centers for network security operations, and Cedarpoint personnel have broad access to Northgate Americas' network traffic and systems. This access creates a significant data-exposure vector: if Cedarpoint's security practices are inadequate, or if its NOC facilities are compromised, the consequences for Northgate Americas—a regulated telecommunications company—could be severe, including regulatory enforcement actions, customer class-action litigation, and reputational harm.
Like the IP infringement indemnification, the data breach indemnification obligation is expressly carved out from the aggregate cap and is therefore uncapped. This reflects the potentially catastrophic scope of a network-wide data breach affecting 340 nodes across 28 US states and 3 Canadian provinces.
The data breach indemnification interacts with two other MSA exhibits. Exhibit E (Data Security and Privacy Requirements) sets forth detailed requirements for Cedarpoint's data security practices, including encryption standards, access control protocols, vulnerability management, penetration testing schedules, and breach notification procedures. Exhibit F (Insurance Requirements) mandates cyber liability insurance coverage of $25,000,000 per occurrence and $50,000,000 in the aggregate, which provides a direct financial backstop for Cedarpoint's data breach indemnification obligations.
One important qualifier warrants attention: the data breach indemnification is triggered only by Cedarpoint's negligence or willful misconduct, not by strict liability. This is a negotiated position. Our initial draft of the MSA proposed strict liability for data breaches occurring within Cedarpoint's systems—that is, Cedarpoint would bear indemnification responsibility for any breach regardless of fault. Cedarpoint and WGM pushed back forcefully on this position during the negotiation call on April 17, 2023, arguing that strict liability for data breaches would be commercially unreasonable in light of the sophisticated and evolving threat landscape, and that no amount of due care can guarantee against all breaches. After internal consultation with Colette Whitman and discussion with Deirdre Kwan, we agreed to move to a negligence-based trigger, subject to the condition that the data breach indemnification remain carved out from the aggregate cap. The implications of this qualification are discussed in Section VIII.B below.
C. Bodily Injury and Property Damage
Under Section 12.1(c) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against third-party claims for bodily injury or tangible property damage caused by the acts or omissions of Cedarpoint personnel—including employees, contractors, and subcontractors—while performing services on Northgate Americas' premises or at Northgate Americas-designated facilities.
This is a standard provision for managed services agreements involving on-site personnel. It is particularly relevant during the 18-month migration from Greystone Network Solutions' legacy MPLS infrastructure, during which Cedarpoint technicians will be physically present at Northgate Americas' data centers and network node locations across 28 US states and 3 Canadian provinces. The migration involves physical installation and configuration of SD-WAN hardware at each of the 340 nodes, creating ongoing bodily injury and property damage exposure throughout the migration period.
Unlike the IP infringement and data breach indemnification obligations, the bodily injury and property damage indemnification is subject to the aggregate indemnification cap described in Section V below. This is consistent with market practice, as bodily injury and property damage claims in the context of technology services engagements are typically insurable and do not present the same catastrophic-loss profile as IP infringement or data breach claims.
Cedarpoint's bodily injury and property damage indemnification is supported by the CGL insurance requirement under Exhibit F, which mandates coverage of $5,000,000 per occurrence and $10,000,000 in the aggregate.
D. Regulatory Penalties
Under Section 12.1(d) of the draft MSA, Cedarpoint shall indemnify Northgate Americas against regulatory penalties, fines, or sanctions arising from Cedarpoint's failure to comply with applicable telecommunications regulations in the performance of the managed network services.
This provision is significant given Northgate Americas' status as a subsidiary of NTP, a regulated telecommunications company. Northgate Americas' network operations are subject to regulatory oversight by the Federal Communications Commission ("FCC") and state public utility commissions in each of the 28 US states where it operates, as well as the Canadian Radio-television and Telecommunications Commission ("CRTC") and relevant provincial regulators in British Columbia, Ontario, and Manitoba. Because Cedarpoint's managed network services are integral to Northgate Americas' telecommunications infrastructure, a failure by Cedarpoint to comply with applicable regulations—for example, emergency services interconnection requirements, network reliability standards, or data privacy regulations—could expose Northgate Americas to regulatory enforcement actions and financial penalties.
The regulatory penalty indemnification is subject to the aggregate indemnification cap and is not carved out.
An important open issue relates to the causation standard for this provision. In its April 21, 2023 redline, Cedarpoint proposed modifying the indemnification trigger from "arising from Cedarpoint's failure to comply with applicable telecommunications regulations" to "arising from regulatory penalties directly and solely caused by Cedarpoint's acts or omissions." This narrowing language would significantly limit Cedarpoint's exposure by requiring Northgate Americas to demonstrate that a regulatory penalty was both "directly" and "solely" caused by Cedarpoint—excluding cases where Cedarpoint's non-compliance was a contributing cause but not the sole cause, and potentially introducing fact-intensive causation disputes. As discussed in Section IX below, we recommend resisting this narrowing language and maintaining the broader "arising from" causation standard.
IV. Northgate Americas' Indemnification Obligations
Northgate Americas' indemnification obligations under the MSA are more limited in scope than Cedarpoint's, reflecting the fundamental asymmetry of the service provider/customer relationship. Northgate Americas' obligations are organized into two principal categories.
A. Misuse of ArcMesh Platform Outside Licensed Scope
Under Section 12.2(a) of the draft MSA, Northgate Americas shall indemnify, defend, and hold harmless Cedarpoint and its affiliates from and against any third-party claims, suits, actions, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from Northgate Americas' use of the ArcMesh platform outside the scope of the license granted under the MSA.
The ArcMesh license under the MSA is limited to managed network operations across the 340 designated nodes in the United States and Canada. Any use of the ArcMesh platform beyond this scope—including, without limitation, sublicensing to third parties, use for the benefit of non-Northgate entities, reverse engineering, decompilation, or disassembly of the ArcMesh platform code—would trigger Northgate Americas' indemnification obligation.
This provision functions as a symmetry mechanism: it mirrors Cedarpoint's IP infringement indemnification obligation under Section III.A above, but applies to the converse scenario. Where Cedarpoint bears risk for IP infringement inherent in the ArcMesh platform itself, Northgate Americas bears risk for IP claims arising from its own misuse of the licensed technology. This allocation is logical and commercially reasonable. Northgate Americas controls its own use of the ArcMesh platform and is in the best position to ensure that its use remains within the licensed scope.
B. Third-Party Content Claims
Under Section 12.2(b) of the draft MSA, Northgate Americas shall indemnify Cedarpoint against third-party claims relating to Northgate Americas-provided data or content transmitted over the managed network.
This provision recognizes the fundamental principle that Cedarpoint, as the managed network services provider, does not control, monitor, or have editorial authority over the content flowing through the network. Northgate Americas and its customers, employees, and end users determine what data and content is transmitted; Cedarpoint merely provides the network infrastructure and management services that facilitate that transmission. Accordingly, Northgate Americas bears the risk of content-related claims, including but not limited to claims sounding in defamation, copyright infringement, invasion of privacy, violation of data protection laws, or breach of third-party contractual restrictions on data transmission.
This obligation interacts with Exhibit D (Acceptable Use Policy) of the MSA, which establishes the parameters for acceptable use of the managed network and imposes certain restrictions on Northgate Americas' use of the network (including prohibitions on transmission of illegal content, malware, or content that violates third-party intellectual property rights). Compliance with the Acceptable Use Policy does not, however, relieve Northgate Americas of its indemnification obligation under this section.
V. Aggregate Indemnification Caps
The MSA establishes an asymmetric cap structure that limits each party's aggregate indemnification liability, subject to express carve-outs for certain high-risk categories of claims. The cap structure is analyzed below.
A. Cedarpoint's Aggregate Cap
Cedarpoint's aggregate indemnification liability under the MSA is capped at 200% of the aggregate fees paid by Northgate Americas during the twelve-month period immediately preceding the date of the claim giving rise to the indemnification obligation.
Based on the ACV of $15,000,000, the effective cap in a stabilized year (i.e., Year 2 onward, assuming consistent fee payments) is calculated as follows:
200% × $15,000,000 = $30,000,000
The 200% multiplier reflects the significant risk profile of the engagement. Several factors contributed to the negotiation of this multiplier, including: (i) the embedded nature of the ArcMesh proprietary technology, which creates technology-dependence risk for Northgate Americas; (ii) Cedarpoint's cybersecurity monitoring and incident response obligations, which create data-exposure risk; (iii) the scale of the managed network (340 nodes across 28 US states and 3 Canadian provinces); and (iv) the criticality of the network infrastructure to Northgate Americas' core telecommunications operations.
As a benchmark, the $30,000,000 cap represents approximately 7.1% of Cedarpoint's fiscal year 2022 revenue of $420,000,000. While this is a commercially significant figure, it is not disproportionate to Cedarpoint's financial capacity and is consistent with the upper end of market practice for managed network services engagements of comparable scale and complexity (see Section VIII.C below).
One important drafting issue requires attention. The cap is structured as a trailing 12-month calculation, meaning it is based on the aggregate fees actually paid during the 12 months preceding the claim date. In the early months of Year 1, this calculation produces a materially lower effective cap. For example:
•  After Month 1: 200% × $1,250,000 = $2,500,000
•  After Month 3: 200% × $3,750,000 = $7,500,000
•  After Month 6: 200% × $7,500,000 = $15,000,000
•  After Month 12: 200% × $15,000,000 = $30,000,000
This ramp-up effect creates a window of reduced protection during the first 12 months of the MSA term—precisely when the risk of claims may be highest, given the complexity and operational disruption associated with the 18-month migration from Greystone Network Solutions' legacy MPLS infrastructure. As discussed in Section IX below, we recommend adding express language to the MSA providing that for claims arising during the first 12 months, the cap is calculated based on the annualized ACV (i.e., projected fees for 12 months) rather than actual fees paid to date.
B. Northgate Americas' Aggregate Cap
Northgate Americas' aggregate indemnification liability under the MSA is capped at 100% of the aggregate fees paid by Northgate Americas during the twelve-month period immediately preceding the date of the claim giving rise to the indemnification obligation.
Based on the ACV of $15,000,000, the effective cap in a stabilized year is:
100% × $15,000,000 = $15,000,000
The asymmetry in caps—200% for Cedarpoint versus 100% for Northgate Americas—reflects the fundamental risk allocation in the MSA. Cedarpoint, as the service provider and licensor of embedded proprietary technology, bears greater exposure to third-party claims (particularly IP infringement and data breach claims) than Northgate Americas, which is the customer and licensee. The 100% cap for Northgate Americas is consistent with median market practice for enterprise technology services agreements of this scale, and Cedarpoint did not challenge the asymmetric structure in its April 21 redline.
The same trailing 12-month calculation issue described above in connection with Cedarpoint's cap also applies to Northgate Americas' cap. For consistency, any annualized calculation provision added for Cedarpoint's cap should also apply to Northgate Americas' cap.
C. Carve-Outs from Aggregate Caps (Uncapped Obligations)
The following categories of indemnification are expressly carved out from the aggregate caps and are therefore subject to uncapped liability:
1. Intellectual Property Infringement. Cedarpoint's obligation to indemnify, defend, and hold harmless Northgate Americas against third-party IP infringement claims under Section 12.1(a) of the MSA (as described in Section III.A above) is uncapped. This carve-out is critical given Northgate Americas' inability to independently assess or mitigate intellectual property risk in the ArcMesh platform, and the potentially catastrophic consequences of an IP infringement finding that could require removal or replacement of the ArcMesh technology across all 340 network nodes.
2. Willful Misconduct. Indemnification obligations arising from the willful misconduct of either party are uncapped. This is a standard carve-out reflecting the well-established public policy principle that a party should not be permitted to cap its liability for intentional wrongdoing. Under New York law, provisions purporting to limit liability for willful misconduct are generally unenforceable, making this carve-out both commercially appropriate and legally prudent.
3. Data Breach. Cedarpoint's obligation to indemnify Northgate Americas against data breaches caused by Cedarpoint's negligence or willful misconduct under Section 12.1(b) of the MSA (as described in Section III.B above) is uncapped. This carve-out reflects the potentially catastrophic scope of a network-wide data breach affecting Northgate Americas' 340-node managed network, which could give rise to regulatory fines across multiple US and Canadian jurisdictions, class-action litigation by affected individuals, contractual liability to Northgate Americas' customers, and severe reputational harm.
4. Confidentiality Breach. Indemnification obligations arising from either party's unauthorized disclosure of confidential information exchanged under the MSA are uncapped. This carve-out protects against the unauthorized disclosure of trade secrets, proprietary technology specifications, business plans, financial data, and other confidential information shared between the parties under the MSA and the predecessor Mutual Non-Disclosure Agreement dated February 22, 2023.
These four carve-outs represent Northgate Americas' key negotiated protections within the indemnification framework. They ensure that Cedarpoint's aggregate cap does not shield it from liability in the categories of claims that present the greatest potential exposure to Northgate Americas. As discussed in Section IX below, these carve-outs should not be conceded in further negotiations with WGM.
VI. Procedural Mechanics for Indemnification Claims
The MSA establishes detailed procedural requirements governing the assertion, defense, and resolution of indemnification claims. These mechanics are set forth in Section 12.3 of the draft MSA and are summarized and analyzed below.
A. Notice Requirements
The indemnified party must provide prompt written notice to the indemnifying party of any third-party claim for which indemnification is sought under the MSA. The notice must include reasonable detail of the claim, including:
(i) the nature and basis of the third-party claim;
(ii) the amount of damages or other relief sought (if known or reasonably ascertainable);
(iii) the identity of the third-party claimant; and
(iv) copies of all relevant correspondence, pleadings, subpoenas, or other filings received by the indemnified party in connection with the claim.
The MSA provides that a failure to provide timely notice does not relieve the indemnifying party of its indemnification obligation, except to the extent the indemnifying party is materially prejudiced by the delay. This standard is consistent with New York law and market practice. It protects the indemnified party against forfeiture of its indemnification rights due to inadvertent delay, while preserving the indemnifying party's right to assert a prejudice-based defense in cases where the delay has caused actual harm (e.g., the loss of an early settlement opportunity or the destruction of evidence).
B. Defense and Control of Proceedings
The indemnifying party has the right, but not the obligation, to assume control of the defense of any third-party claim for which indemnification is sought. To exercise this right, the indemnifying party must deliver written notice to the indemnified party within a reasonable period after receiving the indemnification notice.
The indemnifying party's right to control the defense is subject to the following conditions, each of which is designed to protect the indemnified party's interests:
(i) The indemnifying party must retain defense counsel that is reasonably satisfactory to the indemnified party. This requirement ensures that the indemnified party has confidence in the competence and qualifications of the counsel managing the defense;
(ii) The indemnifying party may not settle any third-party claim without the indemnified party's prior written consent if the proposed settlement involves an admission of liability on the part of the indemnified party, the imposition of injunctive or other equitable relief against the indemnified party, or any non-monetary terms or conditions affecting the indemnified party's business operations; and
(iii) The indemnified party retains the right to participate in the defense at its own expense with counsel of its choice, even when the indemnifying party has assumed control. This participation right is non-exclusive—it does not displace the indemnifying party's control of the defense but ensures the indemnified party can monitor proceedings and protect its interests.
If the indemnifying party does not assume control of the defense within thirty (30) days of receiving notice of the claim, the indemnified party may assume control of the defense and seek reimbursement of all defense costs and expenses from the indemnifying party. This 30-day deadline creates a clear trigger point and prevents indefinite delay in the organization of a defense.
C. Cooperation.  Both parties are required to reasonably cooperate in connection with any indemnified claim. The cooperation obligation includes providing timely access to relevant records, documents, personnel, and information reasonably necessary for the defense or prosecution of the claim. The costs of compliance with the cooperation obligation are borne by the indemnifying party, which is appropriate given that the indemnifying party bears the economic burden of the claim and benefits from the indemnified party's cooperation.
D. Mitigation.  Both parties have a duty to take commercially reasonable steps to mitigate damages in connection with any indemnified claim. This duty is consistent with the general mitigation principle under New York contract law and prevents an indemnified party from passively allowing damages to accumulate when reasonable steps could limit the harm. The "commercially reasonable" standard provides appropriate flexibility, ensuring that the mitigation obligation does not require the indemnified party to incur disproportionate costs or take actions that would materially disrupt its business operations.
VII. Insurance Requirements — Interplay with Indemnification
A. Required Coverage
The MSA, through Exhibit F (Insurance Requirements), requires Cedarpoint to maintain the following minimum insurance coverage throughout the initial term and any renewal periods:
These coverage levels were negotiated based on the total contract value, the scope of Cedarpoint's cybersecurity responsibilities, the geographic breadth of the managed network, and the embedded nature of the ArcMesh technology. The insurance requirements serve as a financial backstop for Cedarpoint's indemnification obligations, ensuring that Cedarpoint's contractual commitments are supported by the claims-paying capacity of a creditworthy insurance carrier.
B. Current Carrier
Cedarpoint's current insurance carrier for the cyber liability and technology errors and omissions policies is Braeburn Mutual Insurance Company, headquartered at 280 Farmington Avenue, Hartford, Connecticut 06105. Braeburn Mutual is a well-established specialty insurer in the technology and cyber liability markets. Certificates of insurance evidencing the required coverage and naming Northgate Americas, Inc. as an additional insured are to be delivered as a closing deliverable prior to the MSA effective date.
C. Analysis of Coverage Adequacy Relative to Indemnification Exposure
The adequacy of Cedarpoint's insurance coverage must be assessed in relation to both its capped and uncapped indemnification obligations.
Capped obligations. Cedarpoint's aggregate indemnification cap of 200% of trailing 12-month fees ($30,000,000 in a stabilized year) is well within the coverage limits of the required insurance policies. The cyber liability coverage ($25,000,000 per occurrence / $50,000,000 aggregate) provides substantial backing for data breach indemnification obligations. The technology E&O coverage ($20,000,000 per occurrence / $40,000,000 aggregate) covers errors, omissions, and failures in the delivery of managed network services and the performance of the ArcMesh platform. The CGL coverage ($5,000,000 per occurrence / $10,000,000 aggregate) covers bodily injury and property damage claims arising from Cedarpoint personnel on Northgate Americas' premises. In total, the aggregate insurance limits across the three policy types sum to $100,000,000, providing a meaningful financial cushion above the $30,000,000 indemnification cap.
Uncapped obligations. The four carve-outs from the aggregate cap—IP infringement, willful misconduct, data breach, and confidentiality breach—present residual risk beyond the insurance limits. A catastrophic IP infringement judgment, for example, could theoretically exceed the combined insurance limits, particularly if the judgment includes injunctive relief requiring a technology migration. Similarly, a willful misconduct carve-out, by definition, may not be covered by insurance policies that typically exclude intentional acts from coverage.
However, the $100,000,000 in aggregate insurance limits provides a meaningful backstop even for uncapped claims. In practice, most indemnification claims in technology services engagements are resolved within the insurance limits, and the uncapped carve-outs serve primarily as a risk-allocation mechanism and deterrent rather than as a frequently invoked recovery path.
Recommendation. We recommend including the following provisions in the MSA to strengthen the insurance-indemnification interplay:
(i) An express requirement that Cedarpoint maintain the required coverage throughout the MSA term and any renewal periods, without reduction, cancellation, or material modification;
(ii) A requirement that any material reduction in coverage, change of carrier, or cancellation of any required policy triggers a 30-day advance written notice obligation to Northgate Americas, providing the Customer with an opportunity to assess the impact and, if necessary, exercise remedial rights under the MSA; and
(iii) Confirmation of Braeburn Mutual Insurance Company's current financial strength ratings and financial stability through Northgate Americas' risk management team, to ensure that the insurance backstop is supported by a carrier with adequate claims-paying capacity.
D. Additional Insured and Subrogation Waivers
The MSA requires that Northgate Americas, Inc. and Northgate Telecommunications PLC be named as additional insureds on all required insurance policies. The additional insured endorsement provides Northgate Americas and NTP with direct rights under the policies, enabling them to access insurance proceeds without relying solely on Cedarpoint's cooperation. This is particularly important in the event that Cedarpoint becomes insolvent, uncooperative, or unable to manage a claim.
The MSA further requires a waiver of subrogation in favor of Northgate Americas and NTP on all required policies. The subrogation waiver prevents Cedarpoint's insurance carrier from pursuing recovery against Northgate Americas or NTP after paying a claim on Cedarpoint's behalf. Without the waiver, the carrier could theoretically assert subrogation rights against Northgate Americas if the carrier determined that Northgate Americas' actions contributed to the loss—a result that would undermine the indemnification framework.
Together, the additional insured endorsement and subrogation waiver reinforce the indemnification framework by providing Northgate Americas with direct recourse to insurance proceeds and eliminating the risk of carrier-initiated recovery actions.
VIII. Risk Assessment
A. Strengths of the Current Indemnification Framework
The indemnification framework negotiated in the MSA provides Northgate Americas with several significant protections:
1. Asymmetric caps favor Northgate Americas. The 200% cap on Cedarpoint's aggregate indemnification liability versus the 100% cap on Northgate Americas' liability reflects the appropriate allocation of risk in a service provider/technology licensor relationship. Cedarpoint, as the party contributing proprietary technology, cybersecurity services, and on-site personnel, bears the greater indemnification burden. This asymmetry was a key negotiation objective and has been preserved through the April 21 redline.
2. Broad uncapped carve-outs. The four uncapped carve-outs—IP infringement, willful misconduct, data breach, and confidentiality breach—protect Northgate Americas against the most significant risk categories in the engagement. These carve-outs ensure that the aggregate cap does not function as a ceiling on Cedarpoint's liability in precisely the scenarios where Northgate Americas' exposure is greatest.
3. Duty to defend for IP infringement. Cedarpoint's obligation to defend, not merely indemnify, against IP infringement claims shifts the burden of litigation management, counsel selection, and cost advancement to Cedarpoint. This is a materially stronger protection than a simple indemnification obligation and is particularly valuable in the context of complex patent litigation.
4. Strong insurance backstop. The $100,000,000 in aggregate insurance limits across three policy types, with Braeburn Mutual Insurance Company as the underwriting carrier, provides a substantial financial backstop for Cedarpoint's indemnification obligations. The insurance requirements ensure that Cedarpoint's contractual commitments are supported by institutional capital, reducing the risk of uncollectible indemnification claims.
5. Regulatory penalty indemnification. The inclusion of regulatory penalty indemnification—rare in many technology services agreements—recognizes the unique risk profile of this engagement, in which Cedarpoint's managed network services are integral to Northgate Americas' operations as a regulated telecommunications company. This provision ensures that Cedarpoint bears the financial consequences of its own regulatory non-compliance.
B. Residual Risks and Concerns
Notwithstanding the strengths identified above, the indemnification framework presents several residual risks and open issues that warrant attention:
1. First-year cap calculation ambiguity. As discussed in Section V.A above, the trailing 12-month cap calculation produces a materially lower effective cap during the first 12 months of the MSA term. If applied literally, Cedarpoint's effective cap after Month 3 would be only $7,500,000 (200% × $3,750,000), rather than the intended $30,000,000 cap. This gap is particularly concerning because the first 12 months coincide with the most complex and risk-intensive phase of the engagement—the migration from Greystone Network Solutions' legacy MPLS infrastructure. We recommend adding express language to the MSA specifying that for claims arising during the first 12 months, the cap is calculated based on the annualized ACV of $15,000,000 rather than actual fees paid to date.
2. Negligence qualifier on data breach indemnification. The data breach indemnification under Section 12.1(b) requires a showing of Cedarpoint's negligence or willful misconduct as a trigger. This qualifier creates a potential gap: a data breach caused by a sophisticated third-party cyberattack exploiting a zero-day vulnerability—without any negligence on Cedarpoint's part—would arguably fall outside the scope of Cedarpoint's indemnification obligation. In such a scenario, Northgate Americas would bear the financial consequences of the breach even though the breach occurred within Cedarpoint's systems and facilities. This gap should be evaluated in the context of the broader risk mitigation framework, including SLA credits under the MSA's service level agreement (Exhibit C), cyber liability insurance coverage under Exhibit F, and the contractual requirement for Cedarpoint to maintain industry-standard security practices under Exhibit E. It remains an open question whether these complementary protections adequately address the residual exposure, or whether a broader data breach trigger should be proposed in the next round of negotiations.
3. Cedarpoint's financial capacity beyond insurance. While Cedarpoint's FY2022 revenue of $420,000,000 suggests a substantial enterprise, Northgate Americas has not conducted financial diligence on Cedarpoint's balance sheet, liquidity, or ability to satisfy uncapped indemnification obligations (particularly a catastrophic IP infringement judgment that could exceed insurance limits). Ridgeline Capital Partners' 62% ownership stake may provide additional financial support in extremis, but no parent guarantee, letter of credit, or other credit support from Ridgeline is required under the current MSA framework. We recommend that Northgate Americas' finance team, through the Dunmore & Pratt LLP audit engagement led by Helen Treadway, review Cedarpoint's most recent audited financial statements to confirm balance sheet adequacy.
4. Subcontractor liability. The MSA should expressly confirm that Cedarpoint's indemnification obligations extend to the acts and omissions of Cedarpoint's subcontractors. Cedarpoint is expected to utilize subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure, and potentially on an ongoing basis for specialized services at certain network node locations. If Cedarpoint's indemnification obligations do not expressly cover subcontractor conduct, a claim arising from a subcontractor's negligence could fall into a gap—Cedarpoint might argue that its indemnification applies only to its own employees, while the subcontractor is not a party to the MSA and therefore owes no direct indemnification to Northgate Americas.
5. Regulatory penalty narrowing language. As noted in Section III.D above, Cedarpoint's April 21 redline proposed limiting the regulatory penalty indemnification to penalties "directly and solely caused by Cedarpoint's acts or omissions." This narrowing language would significantly reduce the practical scope of the provision. The "directly and solely" standard would require Northgate Americas to demonstrate that (a) Cedarpoint's conduct was the direct (not indirect or contributing) cause of the penalty, and (b) Cedarpoint's conduct was the sole cause, with no contributing fault by Northgate Americas or any third party. In practice, regulatory penalties often arise from complex factual circumstances involving multiple contributing factors, making the "solely" requirement particularly problematic. We recommend maintaining the broader "arising from" causation standard.
C. Comparison to Market Practice
The indemnification framework in the MSA is generally consistent with, and in several respects more favorable than, market practice for enterprise managed network services agreements of comparable scale and complexity. The following benchmarks are based on our firm's experience in recent comparable transactions:
•  Service provider cap (200% of trailing 12-month fees): This is at the upper end of the market range for managed services engagements. Typical caps in transactions of this scale range from 100% to 200% of trailing 12-month fees, with the median at approximately 150%. The 200% cap reflects the higher risk profile of this engagement due to the embedded ArcMesh technology and cybersecurity obligations.
•  Customer cap (100% of trailing 12-month fees): This is at the median of market practice for customer indemnification caps in enterprise technology services agreements.
•  Uncapped carve-outs for IP infringement and data breach: These carve-outs are market standard for technology transactions involving proprietary embedded technology and cybersecurity services. Most comparable agreements include uncapped carve-outs for at least IP infringement and willful misconduct; the inclusion of data breach and confidentiality breach as additional carve-outs is a favorable feature of this framework.
•  Insurance minimums ($25M cyber, $20M E&O, $5M CGL): These coverage levels are consistent with market practice for managed services engagements of comparable scale and complexity. Some recent transactions have required higher cyber liability limits (up to $50M per occurrence), but the $25M per occurrence level negotiated here is within the standard range.
IX. Recommendations
Based on the analysis set forth above, we recommend the following actions in preparation for the next round of negotiations with Whitfield Graves & Morrow LLP and the circulation of the second draft MSA, currently targeted for May 5, 2023:
1. Confirm annualized cap calculation for first 12 months. Add express language to Section 12.4 of the MSA providing that, for claims arising during the first 12 months of the initial term, each party's aggregate indemnification cap shall be calculated based on the annualized annual contract value (i.e., $15,000,000 for Northgate Americas' fee obligations) rather than the aggregate fees actually paid during the preceding 12-month period. This eliminates the ramp-up gap that would otherwise reduce Cedarpoint's effective cap during the most risk-intensive phase of the engagement.
2. Resist Cedarpoint's narrowing of regulatory penalty indemnification. Maintain the "arising from" causation standard in Section 12.1(d) and reject Cedarpoint's proposed "directly and solely caused by" formulation. The narrowing language would introduce an unworkably high burden of proof and would effectively nullify the regulatory penalty indemnification in many realistic scenarios involving contributing causes. If Cedarpoint presses this point, a potential compromise would be to accept "arising from Cedarpoint's material failure to comply with applicable telecommunications regulations" (adding a materiality qualifier) while rejecting the "directly and solely" causation standard.
3. Confirm subcontractor coverage. Ensure that Cedarpoint's indemnification obligations under Section 12.1 expressly cover the acts and omissions of Cedarpoint's employees, agents, contractors, and subcontractors. This is particularly important given Cedarpoint's anticipated use of subcontractors during the migration from Greystone Network Solutions' legacy MPLS infrastructure. Proposed language: "Cedarpoint's indemnification obligations under this Section 12.1 shall apply to claims arising from the acts or omissions of Cedarpoint's employees, agents, contractors, and subcontractors to the same extent as if such acts or omissions were performed by Cedarpoint directly."
4. Evaluate data breach causation gap. Schedule a discussion with Colette Whitman and the Northgate Americas client team (Deirdre Kwan and Katrina Bosch) to evaluate whether to propose a broader data breach trigger in the next draft. Options include: (a) strict liability for any breach occurring within Cedarpoint's systems regardless of fault (our original position, which was previously rejected by Cedarpoint); (b) a rebuttable presumption of negligence for any breach occurring within Cedarpoint's systems, shifting the burden to Cedarpoint to demonstrate that it complied with all applicable security standards; or (c) maintaining the current negligence standard while strengthening the complementary protections under Exhibit C (SLA credits), Exhibit E (Data Security Requirements), and Exhibit F (Insurance Requirements). This decision should be informed by Northgate Americas' risk tolerance and the relative importance of this issue in the broader negotiation context.
5. Require advance notice of insurance changes. Add a provision to Exhibit F requiring Cedarpoint to provide 30 days' advance written notice to Northgate Americas of any material reduction in coverage, change of carrier, or cancellation of any required insurance policy. This notice requirement ensures that Northgate Americas has an opportunity to assess the impact of any change in the insurance backstop and, if necessary, exercise remedial rights under the MSA (including, potentially, a right to terminate for material breach if adequate replacement coverage is not obtained).
6. Financial diligence on Cedarpoint. Given the uncapped carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach, we recommend that Northgate Americas' finance team—through the Dunmore & Pratt LLP audit engagement led by Helen Treadway—obtain and review Cedarpoint's most recent audited financial statements. The review should focus on Cedarpoint's balance sheet, liquidity position, debt obligations, and overall financial capacity to satisfy uncapped indemnification obligations that could exceed the insurance limits. If the financial review reveals concerns about Cedarpoint's capacity, we should consider whether to require a parent guarantee or other credit support from Ridgeline Capital Partners, LP.
7. Coordinate with Garrett Simmons on tax indemnity. Confirm that the general indemnification framework under Section 12 does not conflict with or duplicate the specific tax indemnity provisions being developed separately by Garrett Simmons for the MSA. The tax indemnity provisions are expected to address sales and use tax obligations, withholding tax requirements, and cross-border tax obligations arising from Cedarpoint's operations in the three Canadian provinces (British Columbia, Ontario, and Manitoba). The general indemnification framework should include a cross-reference to the tax indemnity provisions to avoid ambiguity regarding which section governs tax-related claims.
8. Preserve all four uncapped carve-outs. The carve-outs for IP infringement, willful misconduct, data breach, and confidentiality breach represent the core risk-allocation protections in the indemnification framework. These carve-outs should not be conceded or narrowed in further negotiations with Whitfield Graves & Morrow LLP. If WGM proposes caps or sub-limits on any of the carved-out categories, we should respond that these carve-outs are non-negotiable and fundamental to Northgate Americas' willingness to enter into the MSA.
X. Conclusion
The indemnification framework in the draft MSA provides Northgate Americas with robust protections that are commensurate with the $75,000,000 total contract value, the embedded ArcMesh technology licensing component, and the cybersecurity risk profile of a 340-node managed network spanning 28 US states and 3 Canadian provinces. The asymmetric cap structure—200% of trailing 12-month fees for Cedarpoint versus 100% for Northgate Americas—combined with uncapped carve-outs for the highest-risk categories (IP infringement, willful misconduct, data breach, and confidentiality breach) and substantial insurance requirements from Braeburn Mutual Insurance Company, represents a favorable risk allocation for Northgate Americas that is at or above market practice for managed services engagements of comparable scale and complexity.
The open issues identified in this memorandum—first-year cap calculation ambiguity, the regulatory penalty causation standard, the data breach negligence qualifier, and subcontractor coverage—are all addressable through targeted drafting revisions in the second draft MSA, currently scheduled for circulation on May 5, 2023. None of these issues presents a structural deficiency in the indemnification framework; rather, they represent opportunities to strengthen and clarify provisions that are already substantially favorable to Northgate Americas.
I am happy to discuss this analysis at your convenience and am available to present the findings to Marcus Harcourt and Deirdre Kwan if that would be helpful in advance of the next negotiation session with Whitfield Graves & Morrow LLP.
cc: Garrett Simmons, Calderwood & Harkness LLP
Enclosures: None
References: MSA first draft dated April 3, 2023; Cedarpoint redline dated April 21, 2023
Coverage Type | Per Occurrence | Aggregate
Cyber Liability Insurance | $25,000,000 | $50,000,000
Technology Errors and Omissions Insurance | $20,000,000 | $40,000,000
Commercial General Liability Insurance | $5,000,000 | $10,000,000

MEMORANDUM

Record

Parties

Dates

Amounts