Standard Security Commitments Schedule
Contract exhibit stating the security commitments the organisation offers by default.
Available soon
- Format
- Word
- Size
- 58 KB
- Length
- 14 pages
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Using this schedule
A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.
This schedule is where [[Organisation Name]] makes its security promises. A customer who asks in a form for a notice period, a test cycle or a right to audit is pointed here (QG-09, QG-21). The exhibit is the section headed “Security commitments schedule”. It is written for the customer. This section and everything after the exhibit are for your staff, and you remove them before the exhibit goes out.
Five steps take the schedule from this template to a signed exhibit:
- Confirm every commitment. The owner named for it in the table below checks that the control runs and that evidence exists. A commitment you cannot support today is changed first, with Legal, and is never left in the text.
- Set the schedule fields. 8 of 10 commitments hold at least one [[value]] to set. Two hold none. The table in the negotiation guide says where each value comes from.
- Offer it at the start. The account owner offers the standard wording with the security overview (Customer-Facing Security Overview Document). The account owner writes no security answer.
- Use the ladder if the customer wants other wording. Standard wording first, then the pre-approved alternative, then an exception. Each step has its own approvers.
- Sign it, keep it and log the rest. Keep the signed copy with the response. A commitment made in or around a response that the schedule does not hold goes in the commitments log of the Questionnaire Request Tracker, with the support it rests on (QG-17).
Guidance — delete before approval
Every statement in the exhibit is a promise the customer can hold you to. Each one is either a [[placeholder]] you complete or an EXAMPLE value you replace. Do not issue the exhibit until the owner of each commitment has confirmed, against evidence, that it is true of your organisation and of the services covered.
This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.
The numbers 1 to 10 in the exhibit follow SC-01 to SC-10 in the guide. The SC numbers are internal. Do not send them.
Before you issue
Each commitment has an owner. The owner checks the control and signs. The Head of Information Security and Legal approve the schedule only when all ten are confirmed. The third column is the clause a customer that follows the third-party model asks of its own suppliers (P06-A07).
Commitment | Owner | Customer asks for (P06) | Check before issue (rules behind it) | Sign-off |
|---|---|---|---|---|
SC-01 Security measures | Head of Information Security | CL-01 Security requirements and standards | The security overview describes the measures and carries the version and date you enter. (P04 PF-03, P05 RM-09) | [[Name, date]] |
SC-02 Security incident notice | Head of Information Security | CL-07 Security incident notification | The incident notification procedure sets a customer notice period, and the communications lead can send the notice. (P09 IM-09, P09 RD-05, P09 RD-09, P18 RN-14, P18 RN-15) | [[Name, date]] |
SC-03 Assurance and audit | Head of Information Security | CL-03 Right to audit and access | Every item on the assurance list is in the evidence index, in date, and may go to this customer. (P20 CA-01, P06 TP-04) | [[Name, date]] |
SC-04 Sub-processors and subcontractors | Head of Information Security | CL-04 Sub-processors and subcontracting | The supplier list exists and can be given on request, and supplier contracts carry matching terms. (P06 TP-07, P06 TP-10) | [[Name, date]] |
SC-05 Return and deletion of data | Head of IT | CL-13 Data return and deletion | The backup cycle supports the backup period, and the hosting contract allows deletion on that timetable. (P06 exit timing, P22 RR-12) | [[Name, date]] |
SC-06 Confidentiality | Legal | CL-01 Security requirements and standards | Staff and contractor terms carry a duty of confidentiality. (P13 JML-04, P15 CL-01) | [[Name, date]] |
SC-07 Security testing | Head of IT | CL-12 Penetration testing and security testing | An independent test of the service runs in the cycle you enter, and a summary exists. (P20 CA-01, P17 PM-03) | [[Name, date]] |
SC-08 Continuity and recovery | Head of IT | CL-10 Business continuity and disaster recovery | A recovery test of the service runs in the cycle you enter, and an attestation can be signed. (P22 RR-14, P23 BR-01) | [[Name, date]] |
SC-09 Assistance with your obligations | Legal | CL-11 Cooperation in our incident response | A contact and a cost basis exist, and Legal and Finance have agreed the basis. (P09 IM-06, P18 RN-02) | [[Name, date]] |
SC-10 Notice of material change | Head of Information Security | CL-20 Notice of material changes | Change control flags a change that reduces security and sends it to the account owner before release. (P06 TP-09) | [[Name, date]] |
Security commitments schedule
Schedule [[number]] to the agreement dated [[date]]
Item | Entry |
|---|---|
Agreement | [[Title and reference of the agreement]] |
Supplier | [[Organisation Name, registered address]] |
Customer | [[Customer name, registered address]] |
Services covered | [[The services named in the agreement]] |
Version of this schedule | [[Version and date]] |
Customer security contact | [[Name, role, channel]] |
Supplier security contact | [[Name, role, channel]] |
In this schedule “we” and “us” mean [[Supplier short name]], and “you” means [[Customer short name]]. The commitments apply to the services covered.
1. Security measures
1.1 We maintain technical and organisational security measures that are appropriate to the risk to your information and to the services we provide to you, taking into account the state of the art and the cost of implementation. We describe them in our security overview, [[version and date]]. We do not reduce their overall level during the term.
2. Security incident notice
2.1 If we become aware of a security incident that affects your information or the services we provide to you, we tell you without undue delay and within the period in [[Schedule field: notice period]]. We tell you through your named security contact, say what we know and what we are doing, and update you as we learn more.
3. Assurance and audit
3.1 Each year, on request, we give you our current independent assurance documents for the services we provide to you ([[list: certificates, test summaries, attestation letters]]) and we answer reasonable written questions about them. We do not give access to our systems, premises or the data of other customers. Where a law or a competent authority requires an audit of the services, we cooperate with it on terms we agree in advance.
4. Sub-processors and subcontractors
4.1 We keep a list of the suppliers that handle your information in providing the services, and give it to you on request. We tell you of a change of such a supplier [[notice period]] before it takes effect, and you may object in writing on reasonable grounds. We bind these suppliers to security and data protection terms no less protective than these, and we remain responsible to you for it.
5. Return and deletion of data
5.1 At the end of the services we return your data, or delete it, at your choice. We delete it from live systems within [[30]] days of the end of the services and from backups within [[90]] days, and we confirm the deletion in writing within [[10]] working days of completing it.
6. Confidentiality
6.1 We keep your information confidential and use it only to provide the services. People who work for us and see it are bound by a duty of confidentiality, and see it only where their work needs it.
7. Security testing
7.1 We have the online ordering service tested for security by an independent party [[once a year]]. On request, and under a non-disclosure agreement, we give you a summary of the latest test. We deal with findings according to their risk.
8. Continuity and recovery
8.1 We keep continuity and recovery plans for the services we provide to you, and test the recovery of those services [[once a year]]. On request, and under a non-disclosure agreement, we give you a statement of the result of the latest test.
9. Assistance with your obligations
9.1 We help you to meet your own obligations that depend on the services, such as an incident investigation, a request from your supervisory authority, or a request from the people whose personal data we process for you, on [[cost basis agreed in advance]].
10. Notice of material change
10.1 We tell you in writing before we make a change to the services that materially reduces the security of your information, and we do not make such a change without your agreement.
11. General
11.1 [[Order of precedence: say how this schedule ranks against the agreement, in the agreement's own words.]]
11.2 These responses describe [[organisation]] as at [[date of response]], for the scope each answer states. They are given in good faith to help [[customer]] assess its supplier. They do not change the agreement between us. A commitment is made only in the agreement or in a schedule that both parties have signed.
11.3 [[Variation: refer to the variation clause of the agreement. Changes to this schedule are made in writing and signed by both parties.]]
Signed for the Supplier | Signed for the Customer |
|---|---|
Name: [[Name]] | Name: [[Name]] |
Role: [[Role]] | Role: [[Role]] |
Date: [[YYYY-MM-DD]] | Date: [[YYYY-MM-DD]] |
Signature: [[Signature]] | Signature: [[Signature]] |
Guidance — delete before approval
The exhibit ends here. Everything after this box is internal. Remove it from the copy you send to a customer.
A financial entity customer reads clauses 3 and 4 against DORA Article 30, and a customer that is a controller reads clause 4 against GDPR Article 28. Counsel confirms whether a customer is a financial entity, and what it needs from the services it uses.
Negotiation guide
This guide is for the people who offer the schedule and answer a customer who wants something different. A customer's own contract schedule is read against the standard wording clause by clause. The answer is always one of three steps.
The ladder
Step | What it is | Offered by | Approved by |
|---|---|---|---|
Standard | The commitment as the schedule states it. | Account owner | No approval beyond the schedule's own |
Alternative wording | The pre-approved fallback in the schedule, used as written. | Account owner | Legal and Head of Information Security |
Exception | Anything beyond the fallback. It is a departure from the standard, rated on P05's bands and approved as a P02 exception. | Questionnaire response lead | Legal and the approvers the band sets (next table) |
An exception is a departure from the standard. Legal and the account owner rate the risk it leaves on the impact and likelihood scales of the risk method, and the band sets the approvers. The exception is recorded and expires like any other (P02 EX-05).
Band | Approvers of the exception | Longest term (days) |
|---|---|---|
Low | Legal, Control owner | 365 |
Medium | Legal, Head of Information Security | 180 |
High | Legal, Head of Information Security, Accountable executive | 90 |
Critical | Legal, Board or its equivalent | 30 |
Nobody approves a departure they own. If the owner of the risk is the Head of Information Security, the accountable executive takes that approver's place. An exception that carries personal data adds the Data Protection Officer to the approvers of the commitment (QG-08).
Alternative wording and exceptions
The fallback is used as written. Anything beyond it is an exception.
Commitment | Pre-approved alternative wording | Beyond it, an exception |
|---|---|---|
SC-01 Security measures | We accept your security requirements schedule where each requirement is marked accepted, accepted with the wording shown, or not accepted, in writing. | A requirement that we apply your own policies to our staff or premises, or a measure we do not operate for the service. |
SC-02 Security incident notice | We name the security contact and the channel you prefer, and we confirm them every year. | A period shorter than the one our incident notification procedure sets (P18 RN-15), or a notice for events that are not incidents. |
SC-03 Assurance and audit | One audit by you or an auditor you appoint in any twelve months, on [[notice period]] written notice, limited to the services provided to you, under confidentiality, at your cost and outside our systems that hold other customers' data. | More than one audit a year, access to systems or data of other customers, or an audit without notice. For a financial entity using the service for a critical or important function, counsel decides what Article 30(3)(e) of DORA needs. |
SC-04 Sub-processors and subcontractors | We give notice by updating the list and emailing your named contact. | A right to approve each supplier before use, or a bar on a supplier we already use. |
SC-05 Return and deletion of data | Return in a common file format that we name, with a short extension of the periods where your own instruction delays the return. | A shorter period for backups than our backup cycle allows, or certified destruction of media we do not control. |
SC-06 Confidentiality | Our standard confidentiality terms apply in place of yours where they give the same protection. | A confidentiality period or a penalty term that differs from our standard terms. |
SC-07 Security testing | We confirm the date of the latest test in writing. | A test by your own team or supplier, a test of a system other than the online ordering service, or sight of the full report. |
SC-08 Continuity and recovery | We describe the recovery objectives the service is designed to, without promising them. | A recovery time or recovery point written as a promise or backed by a service credit. |
SC-09 Assistance with your obligations | We name a contact and a service desk route, and agree the cost basis before work starts. | Assistance at no cost without a limit, or in a period we cannot meet. |
SC-10 Notice of material change | We tell you of the change and the reason, and agree a date for it. | A right to veto changes that do not reduce security. |
Guidance — delete before approval
A right of audit is the request most often raised. The standard wording for SC-03 gives report-based assurance and no access to systems, premises or other customers' data. A customer that wants more is asking for an exception, and Legal decides it.
A financial entity customer using the service for a critical or important function may ask for rights that the standard wording does not give. Counsel decides what the regulation needs. Do not agree to more in an email or on a call.
Setting the schedule fields
10 placeholders sit in the customer wording of 8 commitments. Replace each before the exhibit goes out.
Commitment | Placeholders in the exhibit | Where the value comes from |
|---|---|---|
SC-01 Security measures | [[version and date]] | The version and date of the security overview you give this customer (the overview document of this pack). |
SC-02 Security incident notice | [[Schedule field: notice period]] | The period the incident notification rules set (P18 RN-15, which refers to P09 RD-09). Write no period of your own. A shorter period in the customer's contract is an exception. |
SC-03 Assurance and audit | [[list: certificates, test summaries, attestation letters]] | Items from the evidence index whose tier lets this customer have them today. Name each by title, scope, issuer and dates (EV-14). Label a supplier's item as the supplier's (EV-11). |
SC-04 Sub-processors and subcontractors | [[notice period]] | A notice period you can keep. Procurement and the supplier contracts show what you can give. |
SC-05 Return and deletion of data | [[30]] [[90]] [[10]] | The exit timing the third-party pack asks of your own suppliers. The schedule offers customers the same. Check the backup cycle supports the backup period (P22 RR-12). |
SC-07 Security testing | [[once a year]] | The cycle the independent test runs in today. Promise no more often than it runs. |
SC-08 Continuity and recovery | [[once a year]] | The cycle the recovery test runs in today. Promise no more often than it runs. |
SC-09 Assistance with your obligations | [[cost basis agreed in advance]] | A basis Legal and Finance have agreed, such as a day rate or no charge up to a limit. |
Worked example
EXAMPLE, not part of the schedule. The organisation is the one used throughout the pack: a wholesale distributor with about 900 staff, three warehouses and an online ordering service, an important entity under NIS2 in its Member State. It sells to business customers: retailers, a hospital group and a regional public body. All values are as at 30 Sep 2026. Replace them, or delete this section before approval.
Three requests, three steps
Request | What the customer asked | Step of the ladder |
|---|---|---|
R-2026-029 Regional public body | A contract security schedule, with the customer's own wording. | Legal and the Head of Information Security read it against the standard wording. Wording that matches a commitment stays standard. A fallback in the table above is alternative wording. Anything else is an exception, rated on the bands. |
R-2026-030 Convenience-store chain | An audit request. The customer asked to visit. | Standard. Legal offers report-based assurance (SC-03). If the customer insists on a visit, that is an exception. |
R-2026-031 Hospital group | A form of 300 questions. Question Q-266: “Can we audit your premises and systems?” | The draft said “Yes, you may audit our premises and systems at any time.” Two checks flagged it (OC-01, OC-06). The answer now points to SC-03, and the form promises nothing. |
Why the form is not the place
A form of 17 Feb 2026 said “We tell all customers of any security incident.” No contract term supported it. The distributor found the error on 8 Sep 2026 and corrected it on 15 Sep 2026. The contract schedule of that customer is now under review (R-2026-029).
What the assurance list holds
SC-03 promises the current assurance documents for the services. Four items of the distributor's evidence index fit the list: EI-01 (public; the provider's); EI-03 (under NDA); EI-07 (under NDA); EI-08 (under NDA). The distributor holds no ISO/IEC 27001 certificate of its own, so the list names none as the distributor's. One of the four expires inside the 60-day warning window: EI-01, the hosting provider's certificate, which the list labels as the provider's. The summary of the March 2026 test (EI-03) is Under NDA. Three of four customers have an agreement in force today. The hospital group does not, because the non-disclosure agreement is with the customer's lawyers.
Guidance — delete before approval
The distributor holds no ISO/IEC 27001 certificate of its own. Its hosting provider holds one for the hosting service. P08's example is a different company, a software firm working towards its first certificate. Do not copy the example's list. Build yours from your own evidence index.
Related documents
Document | Relationship |
|---|---|
Questionnaire Response Governance Method | Rule QG-09: a form is not a contract, and a commitment is made only through this schedule and its ladder |
Evidence & Attestation Library Index | The evidence behind the assurance list, and who may receive each item |
Questionnaire Request Tracker | Where a commitment made outside the schedule is logged, owned and tracked |
Customer-Facing Security Overview Document | The security overview the first commitment refers to |
P06-A07 Supplier Contract Security Clause Library | The clauses a customer that follows the third-party model asks for. The schedule offers the same exit timing |
P02-A02 Security Exception & Waiver Standard | An exception to the standard wording is requested and approved here |
P18-A02 EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR) | The notification duties and periods. The notice period of commitment 2 is set from them, and this schedule states no clock |
Adapting this template
Small organisation
Guidance — delete before approval
Offer all ten commitments, but only after each is true. A small organisation has fewer controls, so a commitment is more likely to need changing than leaving out. Change it with Legal before you send it.
One person may be both the account owner and the questionnaire response lead. Keep the ladder: whoever offers a departure does not approve it. If Legal is an outside adviser, agree how quickly they answer.
Regulated entity
Guidance — delete before approval
A customer that is a financial entity under DORA, or an essential or important entity under NIS2, may ask for more than the standard wording. Counsel decides whether the customer is such an entity and whether the service supports a critical or important function of it. If your organisation is itself regulated, your own sector duties apply as well. This schedule restates none of them.
If you process personal data on a customer's behalf, the processing agreement carries the points of GDPR Article 28(3). This schedule helps with several of them. It does not replace the agreement.
IT and services run by a service provider
Guidance — delete before approval
If your hosting, backups or IT are outsourced, several commitments depend on your provider: deletion from backups (5), the list of suppliers (4), testing (7) and recovery (8). Check that your contract with the provider gives you matching terms before you promise them. The clause library of the third-party pack lists them.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.20 — Addressing information security within supplier agreements | The whole schedule: information security requirements agreed with a customer, in a contract exhibit |
NIST CSF 2.0 | GV.SC-02 — “Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally” | The parties and the security contacts: roles and responsibilities agreed and communicated with the customer |
DORA — Regulation (EU) 2022/2554 | Article 30(1) — the rights and obligations of the financial entity and the ICT third-party service provider “shall be clearly allocated and set out in writing”; the full contract includes the service level agreements and is documented in one written document available on paper or in a downloadable, durable and accessible format | The parties and clause 11: rights and obligations set out in writing, as part of one agreement |
DORA — Regulation (EU) 2022/2554 | Article 30(2) — minimum contract content: services, locations, data protection, data return, service levels, incident assistance, cooperation with authorities, termination rights, training | The whole schedule, for a financial entity customer. Paragraph (a), subcontracting, is clause 4. Paragraph (d), return of data, is clause 5. Paragraph (f), help in an incident, is clause 9. Counsel checks the full Article |
DORA — Regulation (EU) 2022/2554 | Article 30(3) — additional contract content for critical or important functions: full service levels, notice duties, contingency plans and security, testing participation, audit and access rights, exit strategies | Clauses 3 and 8, for a service that supports a critical or important function. Paragraph (e), more than report-based assurance, is the exception trigger of clause 3 |
DORA — Regulation (EU) 2022/2554 | Article 30(3)(e)(ii) — for ICT services supporting critical or important functions, the contract includes “the right to agree on alternative assurance levels if other clients’ rights are affected” | Clause 3: agreeing an alternative level of assurance where the rights of other customers are affected |
GDPR — Regulation (EU) 2016/679 | Article 28(2) — a processor does not engage another processor without “prior specific or general written authorisation of the controller”; under a general authorisation it informs the controller of “any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes” | Clause 4: notice of a change of supplier and the customer's chance to object |
GDPR — Regulation (EU) 2016/679 | Article 28(3) — a binding contract with the processor, covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion of data, and audits | The whole schedule, where you process personal data for the customer. Paragraph (b), confidentiality, is clause 6. Paragraph (f), help with the customer's obligations, is clause 9. Paragraph (g), return or deletion, is clause 5. Paragraph (h), information and audits, is clause 3 |
GDPR — Regulation (EU) 2016/679 | Article 28(4) — where a processor engages another processor, “the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor”, and the initial processor “shall remain fully liable to the controller for the performance of that other processor's obligations” | Clause 4: the same terms for the suppliers you use, and your responsibility for them |
GDPR — Regulation (EU) 2016/679 | Article 33(2) — “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” | Clause 2: telling a controller of a personal data breach. The period is set in the incident notification rules |
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026) | Measure MANAGE-03, incident monitoring — “The supplier must notify the healthcare entity without undue delay of incidents that could impact the security of the entity’s network and information systems.” The hospital is told to set up a simple reporting mechanism and to treat a supplier-reported incident as seriously as an internal one | Clause 2: what a hospital customer is told to expect from a supplier when an incident happens |
UK NCSC, Supply chain security guidance | Principle 10, “Build assurance activities into your supply chain management” — “Build the 'right to audit' into all contracts and exercise this.” It adds that this “might not always be possible or desirable, particularly where this relates to a Cloud service”, and that, where justified, a buyer builds in assurance requirements such as penetration tests, external audit or formal security certifications | Clause 3: why a buyer asks for assurance, and why a right to audit is not always practical |
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.
This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
Regulation (EU) 2022/2554 binds the financial entities of its Article 2. Articles 28 to 30 say what a financial entity does about ICT third-party risk and what its contract with an ICT third-party service provider holds. A provider is bound to them through that contract. Article 30(3) asks for more where the service supports a critical or important function of the financial entity. A customer that is not a financial entity cannot rely on Article 30 to ask the same of you. Counsel confirms whether a customer is a financial entity and whether a service supports a critical or important function of it. Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk. ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.
Definitions
Term | Meaning in this schedule |
|---|---|
Schedule | The exhibit to a customer's agreement that states the security commitments. In this document it is the section headed “Security commitments schedule”. |
Commitment | A promise to do something or to provide something, with a date or a continuing duty. A commitment found in an answer is logged, owned and tracked. |
Standard wording | The commitment as the schedule states it. |
Alternative wording | The pre-approved fallback in the schedule, used as written. |
Exception | Anything beyond the fallback. It is a departure from the standard, rated on P05's bands and approved as a P02 exception. |
Schedule field | A [[placeholder]] in the customer wording whose value you set before the exhibit goes out. |