Cybersecurity requirements are integrated into contracts with suppliers

Implementation steps

1. 1

   Define standard security requirements by vendor tier

   Write a set of baseline security requirements for each criticality tier. Critical vendors might need SOC 2 Type II certification, breach notification within 24 hours, right-to-audit clauses, and encryption requirements. Lower-tier vendors might need only basic data processing agreement terms. Having tiered requirements prevents the highest requirements from being used as a reason to skip the process entirely.

   confluencenotiongoogle-docs
2. 2

   Embed security requirements in contracts and data processing agreements

   Work with legal to incorporate your security requirements into standard vendor contracts and data processing agreements. At minimum, include: breach notification timelines, data handling and deletion obligations, security assessment rights, and the requirement to maintain baseline security controls. For critical vendors, add SOC 2 or equivalent certification requirements.

   docusignironcladgoogle-docs
3. 3

   Review existing contracts for security gaps

   Audit your current contracts with critical and high-risk vendors to identify those that lack adequate security terms. Prioritize renegotiation for the highest-risk relationships at the next renewal opportunity. For vendors you cannot renegotiate with immediately, document the gap and implement compensating controls.

   google-sheetsnotion

Evidence required