How to Review a Security-Incident Suspension Clause

Reed, Ops at a 20-person UK SaaS, needs this security-suspend hunt before Friday treats an open “any security risk / AUP” kill-switch as hygiene. Path: fence B94 → threat → material-harm gate → partial scope → notice / restore → data + credits → narrow / partial / walk.

September 2026. English law; courts of England and Wales. The packet — the exact file set before Friday — has Clause 14 of the vendor CRM MSA — master services agreement: “Provider may immediately suspend all Services if it reasonably believes there is any security risk or Acceptable Use Policy concern.” No material-harm gate, partial scope, notice pack, restore clock, or data/credits wording. AE Slack: “Standard kill switch — we need it for the platform. Sign Friday.”

“Any security risk” plus “immediately suspend all Services” is not the same kill-switch as non-payment — and without a material-harm gate it can dark the suite over a suspected probe. Google Cloud Platform Terms §4 Suspension (checked 2026-09-29): Suspend may be all or part; Google may act on suspected unauthorized access and must lift when circumstances resolve. Law Insider Suspension of SaaS Services samples (2026) (checked 2026-09-29): notice and remedy unless use causes immediate, material and ongoing harm — then promptly remove suspension once resolved.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Review the trigger: security threat — or overdue cash?

A genuine security or integrity threat protects the platform, other customers, or Customer Data. Overdue cash is a different kill-switch. Confusing them means Reed reviews the wrong risk while AE sells platform hygiene.

Do: define the trigger as compromise, attack, material integrity harm, or suspected unauthorized access — then fence the invoice hunt. Don’t: let “any AUP concern” swallow Clause 14. Fasthoff on SaaS agreements (US colour, checked 2026-09-29): suspension can cover nonpayment or urgent security threat — define which. For overdue-invoice suspend, open how to review suspension of services for non-payment.

When to allow immediate suspend without a cure window

Immediate suspend belongs only when delay would create material harm. A suspected probe without that gate should not dark the whole CRM.

Do: require notice and an opportunity to remedy unless delay would create material harm to security, integrity, or availability. Don’t: accept “immediately” for every “security risk” belief. Google Cloud colour (checked 2026-09-29): AUP path uses notify + 24-hour correction; Other Suspension covers protect / suspected unauthorized access. In practice, Reed writes the material-harm gate into Clause 14.

How do you keep scope to affected users or components first?

One compromised seat should not offline the whole suite by default. Prefer affected users, tenants, or components — then escalate only if the threat spreads.

Do: draft Suspend as all or part, defaulting to the minimum necessary scope. Don’t: leave “all Services” as the only lever. Law Insider Suspension of SaaS Solutions (2026) (checked 2026-09-29): whole or in part to preserve security and integrity. SIFMA/FSSCC Reconnection Framework (2025 Edition) (checked 2026-09-29): disconnect need not mean every connection. For example, Reed’s Clause 14 only says “all Services.”

What to demand for notice, evidence, and the restore clock

Without written basis, evidence, and a hard restore clock, Reed can sit dark until Provider is “satisfied.” Restore is a drafted duty, not a courtesy.

Do: require prompt written notice of the basis; evidence of the threat and of remediation; restore within a stated clock after resolve or cure. Don’t: accept “when Provider deems appropriate” alone. nhimg on supplier suspension after cyberattack (checked 2026-09-29): restore depends on evidence of containment, not reassurance. Typical mistake: treating Slack “we’ll turn you back on” as the clock.

Review data access and SLA credits while dark

Suspension without export or read-only access strands operations. Automatic wipe of earned SLA credits while dark can punish Reed twice.

Do: keep Customer Data available as of the suspension date (export or read-only); bar automatic wipe of earned credits for provider-side suspend. Don’t: leave both silent. Law Insider Suspension for Ongoing Harm (2026) and Adonis SaaS Addendum (checked 2026-09-29): Customer Data as of the suspension date remains available during suspend — put Reed’s export path on the page.

When to narrow, go partial, or walk

Narrow when the threat is defined and immediate action sits behind a material-harm gate. Go partial when affected scope, data access, and SLA credits can be written. Walk when “any security risk / AUP” → immediate all-Services + no notice/restore stays stacked.

Success bar: one-page log plus one Friday pause sentence (Clause 14 vs “standard kill switch”). Workflow: fence B94 → threat → material-harm gate → partial scope → notice / restore → data + credits → narrow / partial / walk. Optional: upload the same PDF to document analysis for a first-pass — first machine pass extracting clauses — then a named human opens Clause 14. Verify every High flag — high-severity item a human still opens. Escalate to counsel — a qualified lawyer. Never treat the paper as ready to countersign.

Next steps

Fill Reed’s log on Clause 14 before Friday. For a machine first-pass on the same PDF/DOCX, use document analysis — then a human still opens the threat / scope / restore / data / credits stack.