Crafting Public–Private Cyber Partnerships

Mansfeld-Südharz, Germany - October 6, 2025

A field manual for writing contracts that survive ransomware and the inevitable moment when the private side wants to sell

Public-private partnerships in cyber space have a habit of ending like bad marriages: one side wakes up to find the assets gone, the dishes broken, and the pre-nup silent on who keeps the decryption keys. The Cyber Resilience Alliance spent a year in therapy before signing anything, and the resulting contract is less a love letter than a prenuptial agreement written by engineers—dense, granular, and weirdly romantic in its obsession with failure modes. The document is 42 pages long, but its spirit can be distilled into three sentences: the public side never outsources risk, the private side never captures rent, and both parties deposit their crown jewels into a safe whose key is literally kept in a county vault. The rest is footnotes, but footnotes are where divorces are prevented, so we print them here in full daylight.

The first footnote defines the word “partnership.” We borrowed the definition from the old German water boards: a community of purpose, not a community of profit. That sounds semantic until you write the cash-flow clause: every euro that the private side earns from membership fees must be reinvested into the joint venture for the first thirty-six months, and any dividend thereafter is capped at the ten-year German government bond yield plus 200 basis points. The cap is policed by an external escrow accountant who releases excess cash back into the public resilience fund, effectively converting windfall into fire insurance for the county. Investors initially balked—until they realised that the same clause also caps downside: if the venture loses money, the private side cannot be asked to top-up beyond its original capital commitment. Risk and reward are symmetrically bounded, which makes the IRR predictable and the politics survivable.

The second footnote is about data, because that is where modern divorces begin. The contract creates a three-tier asset class: public data (owned by the county), shared data (anonymised IOCs, metrics, playbooks), and proprietary data (vendor source code, ML models). The twist is that every byte that touches the shared SOC is automatically labelled with a machine-readable tag that embeds provenance and usage rights into the metadata itself. Think of it as a nutrition label for information: any analyst who exports a CSV receives a file that already contains the licence conditions in the header row. The technical implementation is boring—an extra key-value pair in the STIX bundle—but the legal effect is dramatic: it makes accidental misuse impossible, which in turn makes lawyers redundant. After six months of operation, the number of data-sharing disputes dropped to zero, not because everyone became virtuous, but because the file format refused to sin.

The third footnote deals with exit, the moment when the private partner is acquired by a larger entity whose headquarters sits under a different flag. Standard contracts handle this with change-of-control clauses that allow the public side to terminate. We flipped the logic: instead of granting an exit veto, we grant an entrance exam. Any acquirer must sign a supplemental deed that inherits all sovereignty obligations, including the data-localisation clause and the dividend cap. If the acquirer refuses, the shares revert to the joint venture at book value, and the public side can buy them back using the same revolving facility that finances working capital. The clause was battle-tested last summer when one of the founding vendors received an offer from a US conglomerate. The conglomerate initially balked at the sovereignty deed, but the escrow accountant triggered the reversion clause within 48 hours, and the shares were repurchased at par. The vendor’s founders walked away with a fair price, the acquirer walked away, and the county kept the technology. The story travelled through the local tech scene like a campfire tale: here, exit is allowed, but exile is not.

"We wrote the divorce before the wedding—so the marriage could survive anything short of nuclear winter."

The fourth footnote is about labour, because the fastest way to hollow out a partnership is to poach the engineers who remember where the bodies are buried. The contract mandates a “cooling-off secondment”: any employee who moves from the public side to the private side within two years of signing must spend six months on the vendor payroll working exclusively on non-county projects, effectively purging short-term memory before competitive access is granted. Conversely, any vendor engineer who rotates into the county SOC must sign a conflict-of-interest pledge that prevents them from selling competing services to local SMEs for twelve months after rotation ends. The clause sounds draconian until you realise it protects both sides: the county cannot be accused of gifting insider knowledge, and the vendor cannot be accused of raiding talent. The result is a labour market that behaves like a slow-release capsule: knowledge circulates, but loyalties dilute gradually enough to prevent shock.

The fifth footnote is the sovereignty dividend, a term we borrowed from defence procurement. Any improvement that is co-funded by public grants is licensed back to the public sector under a government-purpose right, but with a usage ceiling set at 125 % of the original grant value. The ceiling prevents the public side from becoming a competitor while still guaranteeing that the county can deploy the improvement across every municipal utility without paying twice. The meter is tracked in a shared GitLab repository that automatically increments deployment value every time an Ansible playbook runs against a county IP address. When the meter hits the cap, a yellow banner appears in the CI/CD pipeline warning that a new royalty-free licence must be negotiated. The system is transparent, automatic, and immune to creative accounting, which means both sides can forecast cash-flow without hiring forensic auditors every quarter.

The final footnote is about politics, the ultimate solvent of good intentions. The contract creates a “sunset convertible” clause: if the county council ever votes to dissolve the partnership, all shared intellectual property reverts to the public domain immediately, and the private partner receives only the book value of physical assets. The clause sounds punitive, but it is actually protective: it guarantees that no future populist majority can privatise the resilience commons for short-term gain. Conversely, if the private partner petitions for dissolution, the public side has first right to purchase the entire joint venture at fair market value, funded by the same EIF guarantee that underwrites working capital. Either way, the technology stays local, the data stays local, and the county keeps the lights on even while the marriage ends. That is not romantic, but it is stable, and stability is the only currency that matters when the next ransomware wave hits at dawn on a Sunday.

The Cyber Resilience Alliance is a public-private partnership established 2025, led by CypSec, Validato and the County of Mansfeld-Südharz. The Alliance operates a sovereign private-cloud security stack, a shared SOC and an cyber academy, aiming to make Mansfeld-Südharz the reference site for rural cyber resilience by 2030.

Media Contact: Daria Fediay, Chief Executive Officer at CypSec - daria.fediay@cypsec.de.