I am responsible for implementing a software platform provided by a US company. I work in an international company having HQ in Germany, but also offices in Eastern-Europe (within EU).
My security department asked for a security assessment for the platform and provided me with a few dozens questions to be answered. I conveyed them to the provider and they told me that they can only release the answer if we sign a Mutual Non-Disclosure Agreement.
This is where things become trickier because there is a contradiction between this MNDA and our legal department recommendations.
Our legal department recommended the following (emphasis mine):
The non-disclosure agreements are strongly related and accessories to the main legal relationship between the parties. Their existence is justified by the sensitive nature of the information disclosed by the parties during said relationship. Therefore, we strongly recommend limiting the non-disclosure agreement to the information disclosed during your project.
The MNDA stipulates the following (amonng many others, but this is the main issue):
Confidential Information shall mean, subject to the exceptions set forth in Section 2 hereof, any and all technical and non-technical information provided, disclosed, or made available by either Party or their respective agents to the other Party, whether before, on, or after the date of this Agreement, which includes, without limitation: (a) any information or documents provided under or in connection with any current or future agreement between the Parties;
Shortly put, the provider want the MNDA to cover all future interaction (pragmatic approach, less papers to be signed in the future), while our legal department has a more cautious approach (MNDA should cover strictly the provided security assessment document).
I have no legal expertise, but I am curious how are these type of contractions solved in practice. Also, is there an explanation for such a difference of approach in relation to MNDAs? (US vs. Europe)