Suppose your client, a mid-size health care provider, is about to install a new security system connected to the hospital's network, or, a small-size IT vendor is about to provide an electricity distribution system to a utility. Given the latest news on data breaches and cyber attacks on critical infrastructure, the client is understandably concerned about the cyber risks associated with the upcoming IT sales agreement and the legal implications. How do you advise your client?

Already, there are many publications available to assist companies enhance cybersecurity during an IT acquisition. But the hectic speed of change compounds the challenge of digesting these numerous guidelines. Also, a lot of the publications are prepared from a buyer's perspective, which may underserve an IT vendor already burdened by cybersecurity audit requests.

Against this backdrop, introduced below are four key concepts to help a buyer comprehend the various cybersecurity publications and transform them into actionable items implementable during an IT acquisition. The following can also help an IT vendor analyze the legal implications of its sales and determine contact terms to which it can concede.