How do we decide which security clauses go into a contract?

Start

A supplier contract is being drafted or renewed

Security requirements found in an assessment are worth little if they stay in a report. The contract is where they become duties the supplier must meet. Choose the clauses before signature, whether the contract is new or a renewal.

• Then: Does the supplier have a recorded tier?

Decision

Does the supplier have a recorded tier?

The tier drives the selection. A supplier with no tier on your register has not been screened, and no contract or renewal should be signed until it has.

• Yes: Is it Tier 4?
• No, or not known: Stop, and screen and tier it first

Outcome

Stop, and screen and tier it first

Hold the signature until the business owner has answered the intake questions and a tier is recorded. Choosing clauses without a tier ends with either every clause, which the supplier resists, or too few.

Decision

Is it Tier 4?

Tier 4 suppliers hold no data beyond public, have no access and support no service. The ordinary terms of the main contract do the rest.

• Yes: Add the short security clause only
• No: Take every clause the tier marks as required

Outcome

Add the short security clause only

Tier 4 takes the first paragraph of the general security clause: the supplier maintains appropriate measures to protect your information and the service. Nothing more is needed.

Step

Take every clause the tier marks as required

Tier 3 takes three: security requirements, incident notification and termination for security reasons. Tier 2 adds assurance, audit, subcontracting, locations, vulnerability management, supplier staff access, incident cooperation, data return, exit, training, remediation and change notice. Tier 1 adds continuity, penetration testing and service levels with security reporting.

• Then: Add the clauses for the most sensitive data it holds

Step

Add the clauses for the most sensitive data it holds

Read the column for the most sensitive data the supplier will hold or can reach. Personal or customer data brings in assurance, audit, subcontracting, locations, incident notification and cooperation, vulnerability management, data return, termination and change notice. Under the tiering model, personal data alone already places a supplier at Tier 2 at least, and customer data at Tier 1. The tier and the data column together give the list.

• Then: Will it process personal data on your behalf?

Decision

Will it process personal data on your behalf?

Processors need their own contract terms whatever the tier. Ask your Data Protection Officer: a supplier that decides the purposes of the processing itself is a controller, and processor terms do not fit it. If you are not sure, treat it as a processor until the Data Protection Officer says otherwise.

• Yes, or not known: Add the processor terms, checked by your data protection lead
• No: Check each conditional clause against its 'when to use'

Step

Add the processor terms, checked by your data protection lead

GDPR Article 28(3) requires a binding contract covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion, and audits. GDPR Article 28(2) forbids sub-processors without your prior written authorisation. The supplier's own data processing agreement is acceptable if it covers every point. Check it against that list, not against its title.

• Then: Check each conditional clause against its 'when to use'

Step

Check each conditional clause against its 'when to use'

Add the cloud clause for any cloud service holding your data, so the split of security duties is written down. Add cooperation with competent authorities for a regulated entity whose supervisor needs access. At Tier 2, continuity and service levels apply where it supports an important internal service, and testing where it hosts customer data or an internet-facing service you rely on. At Tier 3, the conditional clauses turn on facts such as holding your data, connecting to your systems or subcontracting.

• Then: Are you a DORA financial entity buying an ICT service?

Decision

Are you a DORA financial entity buying an ICT service?

DORA sets minimum contract content for every ICT service a financial entity buys, and more for services supporting a critical or important function. Organisations outside DORA answer no. If your status is unclear, ask Legal or Compliance and treat it as yes meanwhile.

• Yes, or not known: Add the clauses DORA requires in every ICT contract
• No: Was the assessment decision 'Approve with conditions'?

Step

Add the clauses DORA requires in every ICT contract

The pack maps the points of DORA Article 30(2) to clauses: locations, data protection, data return, service levels, incident assistance, cooperation with authorities, termination rights and training. The description of the services sits in the main contract. Record the contract in your register of information.

• Then: Does the service support a critical or important function?

Decision

Does the service support a critical or important function?

If it does, the supplier is Tier 1 by the pack's tiering rules and takes every Tier 1 clause as well. If you are not sure, treat it as yes until Legal or Compliance has applied the test.

• Yes, or not known: Add the extra content for critical or important functions
• No: Was the assessment decision 'Approve with conditions'?

Step

Add the extra content for critical or important functions

DORA Article 30(3) adds full service levels, notice duties, contingency plans and security, participation in testing, audit and access rights, and exit strategies. Audit and access rights for the competent authority are not negotiable away. The pack's tables follow a summary of the Article: have your legal adviser check each contract against the full text of Article 30.

• Then: Was the assessment decision 'Approve with conditions'?

Decision

Was the assessment decision 'Approve with conditions'?

Conditions are findings the supplier must fix by a date. Without a contract term, a finding is only a request in a report.

• Yes: List the findings and deadlines in the remediation schedule
• No: Negotiate from the tier, and accept equivalent wording

Step

List the findings and deadlines in the remediation schedule

The remediation clause turns each finding into a contract term with its deadline. In the pack's clause, a High finding not fixed by its deadline counts as a material breach, which gives you the right to terminate without penalty. The pack recommends the clause in every Tier 1 and Tier 2 contract, so later findings also get contractual deadlines.

• Then: Negotiate from the tier, and accept equivalent wording

Step

Negotiate from the tier, and accept equivalent wording

Tell the supplier why: it gets these clauses because of its tier. Its own wording is fine if it achieves the same outcome. For every supplier holding your data, hold firm on incident notification, data return and deletion, and processor terms. For Tier 1, also supplier staff access, exit and audit. A current certificate with the right scope is a fair trade for an on-site audit, except after an incident or for a regulator.

• Then: Did the supplier refuse a clause you will sign without?

Decision

Did the supplier refuse a clause you will sign without?

Large cloud and software providers often offer only their standard terms. Read them against the library clause by clause and note which points they cover. Any point missing is the same as a refused clause.

• Yes: Record the gap as an exception, co-signed if outside appetite
• No: Sign with the tier's clauses in place

Outcome

Record the gap as an exception, co-signed if outside appetite

A clause given up is a known gap. Record it through your exception process, with an expiry date, instead of accepting the refusal informally at signature. If it leaves the supplier's risk outside appetite, or scored Critical, the approver your risk method requires for that position also signs the exception, and the risk goes on your risk register as well. The stricter of the two approvers applies. Look at it again at the next reassessment.

Outcome

Sign with the tier's clauses in place

The contract carries the clauses for the tier and the data before signature. For Tier 1 and Tier 2, agree the exit plan before the service starts. Keep the list of clauses selected with the contract, so an auditor can check it against the tier.