Those IT Contractors Working in Your Office - What Are They Up to? A Pub Tale in Two Parts: Part 1 - The Business Side

Here's the scenario. You're Steve, an IT project manager for Beta Corporation. You convinced your CFO to hire Acme, a local software development company, to embed four of their guys on your premises to help your overworked IT staff create the Next Big Thing software application. The application will use data from your network. But you're worried about giving Acme's guys access to your network! It has a lot of confidential business information, including customer data. You wonder about the business and legal precautions needed to protect your valuable data. The Acme CEO tells you that everything is fine without a contract (other than Acme's Statement of Work that you signed last week and the NDA that Acme signed when the project went out for bids).

Fortunately, you know a savvy information technology lawyer, Bosco, and decide to pick his brain during a few beers Friday after work at Brewery Vivant in Grand Rapids, Michigan. You are drinking  the Undertaker, a smoky Belgian-style dark ale with notes of chocolate and dark cherries. The choice of Undertaker makes sense because the brew pub is located in a former mortuary chapel. The feeling that you are observed by the dearly departed is palpable. 

Here's how the conversation goes:

Steve: What about Acme doing the Next Big Thing project?

Bosco: I'm concerned about giving Acme's guys access to your network - with its valuable and proprietary data - without some business and legal precautions.

Steve: What business precautions do you think are necessary?

Bosco: Well, what do you know about Acme's programmers who will be at your offices?

Steve: They are really smart and have a lot of experience! Two of the guys are from India; the others are local. We save a lot of money because they are Acme's independent contractors, not its employees. 

Bosco: Do you know if the Indian programmers have received permission to work here from U.S. Citizen and Immigration Services? 

Steve: I assume that Acme took care of this. But this topic didn't come up when we negotiated the deal. 

Bosco: Assumptions can be dangerous. You should ask Acme for proof that the Indian programmers have the appropriate U.S. work visa. If they don't and the authorities catch them, your company could face unfortunate legal and business consequences. Wal-Mart got into trouble over this several years ago. Also, have you asked Acme for background checks on the four programmers?

Steve: Why would I do that?

Bosco: You said that the programmers would have access to your network, but they will also be at your offices for several weeks. For practical (but not legal) purposes, they will be Beta employees. Don't you want to know if they have any felony convictions within the last seven years? 

Steve: Well, that's a good idea! We already run background checks on our IT employees having network access. 

Bosco: And let's talk about what kind of network access the guys will have. Are there any restrictions on what data they can get to? 

Steve: They will need access to a lot of network files to program the Next Big Thing. We don't know exactly what. 

Bosco: I think that you and Acme should try to narrow down the data that Acme will need, and then place these files in a secure "DMZ" that Acme's guys will access. And they should have access only to the DMZ. If they need any additional data, they can ask you for it, and you can place that data in the DMZ as well. That way, Acme's programmers won't be able to access your entire network!

Steve: That makes good sense. What other business safeguards do you recommend? 

Bosco: I bet that Beta has an employee Code of Conduct that includes confidentiality provisions. 

Steve: That's right. We make our employees sign it every year! 

Bosco: That's great. But I think that you should revise it for Acme's programmers to sign, too. 

Steve: But we already have a NDA with Acme. 

Bosco: That's good, but those provisions may not be not legally binding on the Acme programmers because they are not Acme employees. So, each Acme programmer should sign a code of conduct that includes confidentiality provisions. It should also cover other items, such as Beta's no-smoking, dress code, non-compete, and no-solicitation policies. 

Steve: That's a great idea, Bosco! Now what about those legal safeguards? We already have a signed Statement of Work with Acme. It's two pages of really great stuff about what Acme will do to create the Next Big Thing! 

Bosco: IT statements of work usually contain just the business guts of the deal without essential legal protections. So, let's order a few more Undertakers and get down to the legal stuff!

Executive Summary:

Vendor-furnished contractors who access your network call for certain business precautions, including:

· Proof that the contractors are authorized to work in the U.S. if they are not U.S. citizens.

· Background checks.

· Contractors should sign the appropriate code of conduct containing confidentiality, non-compete, and no-solicitation provisions.

· Consider allowing the contractors only restricted access to your network by creating a secure "DMZ."

· The vendor’s Statement of Work or Proposal - even if negotiated - isn’t a sufficient contract for the project because that document usually contains only the business side of the deal. It doesn’t address essential legal elements.

Stay tuned for Part 2, in which the Undertaker keeps flowing - and Steve and Bosco get down to the basic legal provisions that should be in the application development contract between Acme and Beta!