Supplier Contract Security Clause Library

Purpose

This library gives [[Organisation Name]] ready security clauses for supplier contracts, so the requirements found in an assessment reach the contract instead of staying in a report. Each clause has a stable ID (CL-01 to CL-21), says when to use it, what it achieves and how suppliers usually push back, and is written in plain contract English with the values you set in [[double brackets]].

It applies the Third-Party Security Policy's rule TP-07: Contracts must carry the security clauses for the supplier's tier and data type before they are signed. The tier comes from the Supplier Criticality & Tiering Model; the selection matrix below turns the tier and the data type into a list of clauses.

How to use this library

1. Find the supplier's tier in the Supplier Security Risk Register. If it has none, it has not been screened: stop and screen it (TP-01).
2. Read the tier column of the selection matrix: every clause marked Yes (or Short) goes in.
3. Add the data-type clauses: read the column for the most sensitive data the supplier will hold or see, and add every clause marked Yes there.
4. Check the conditions: for every clause marked 'If …' in either column, read its 'When to use' and include it if the condition applies.
5. Add the regulatory clauses if you are a DORA financial entity: every clause in the 'DORA: all ICT services' column for an ICT service, and the 'DORA: critical or important' column when the service supports a critical or important function. For CL-03, use the DORA variant (3D) in place of paragraphs 3.1 to 3.3 when the service supports a critical or important function.
6. Add the conditions from the assessment. Where the decision was 'Approve with conditions', list the findings and their deadlines in the schedule to CL-19.
7. Negotiate, then record the result. Any clause the supplier refuses, and which you accept without it, is a gap: record it as an exception under the Security Exception & Waiver Standard. Where the gap leaves the supplier's risk outside appetite, or with a Severe residual impact, the approver the Information Security Risk Management pack requires for that position also signs the exception, and the risk is entered in the Information Security Risk Register (TP-06). The stricter of the two approvers always applies.

Classification fields

Selection codes:

Clause selection matrix

By tier, and for DORA financial entities

Tier 1 Critical takes every core clause, and the DORA clauses if they apply; Tier 4 Minimal takes the short security clause only.

• Tier 1 Critical: CL-01, CL-02, CL-03, CL-04, CL-05, CL-07, CL-08, CL-09, CL-10, CL-11, CL-12, CL-13, CL-14, CL-15, CL-16, CL-18, CL-19, CL-20; if they apply, CL-06, CL-17, CL-21.
• Tier 2 Important: CL-01, CL-02, CL-03, CL-04, CL-05, CL-07, CL-08, CL-09, CL-11, CL-13, CL-14, CL-15, CL-16, CL-19, CL-20; if they apply, CL-06, CL-10, CL-12, CL-17, CL-18, CL-21.
• Tier 3 Standard: CL-01, CL-07, CL-15; if they apply, CL-03, CL-04, CL-05, CL-06, CL-08, CL-09, CL-13, CL-17, CL-19, CL-21.
• Tier 4 Minimal: CL-01, first paragraph only. Tier 4 suppliers hold no data and have no access, so the main contract's ordinary terms do the rest.
• The DORA columns come from the coverage tables below. Override 1 of the tiering model makes an ICT service supporting a critical or important function Tier 1, so it also takes every Tier 1 clause.

By data type

Read the column for the most sensitive data the supplier holds or can reach (criterion TC-2 of the Supplier Criticality & Tiering Model). A processor of personal data is at least Tier 2 (override 2), so also read that tier's column.

Coverage: regulatory contract content

DORA Article 30(2): all contracts for ICT services

For a financial entity under DORA, the contractual arrangements on the use of ICT services must include at least the nine elements in Article 30(2), (a) to (i). The table prints the text of each element and names the clauses that address it.

DORA Article 30(3): critical or important functions

Contracts for ICT services supporting critical or important functions must include, in addition to the elements in paragraph 2, at least the six elements in Article 30(3), (a) to (f). The table prints the text of each.

GDPR Article 28: processor contracts

Where the supplier processes personal data on our behalf, GDPR Article 28(3) requires a binding contract covering the points below. Article 28(2) forbids another processor without our prior specific or general written authorisation; under a general authorisation the processor must tell us of intended changes and give us the chance to object (CL-04, paragraphs 4.1 and 4.2). Article 28(4) requires the same obligations to be passed to the other processor and keeps the first processor fully liable (4.3).

The Data Protection Officer checks the processor terms, and the description of the processing in CL-06's schedule, before signature. Where the supplier offers its own data processing agreement, check it against this table.

The clauses

Each entry gives the classification fields, the clause text ready to paste, and negotiation notes. Where a paragraph refers to "Schedule [[X]]", create that schedule in the contract. "Security Incident" is defined in CL-07; use the contract's own defined terms for "the Supplier", "the Customer", "the Services" and "this Agreement". The notification window in CL-07 is [[24]] hours by default.

CL-01 Security requirements and standards

Clause text — 1. Security requirements and standards

1.1 The Supplier shall maintain appropriate technical and organisational measures to protect the confidentiality, integrity and availability of the Customer's information and of the Services, taking into account the state of the art, the cost of implementation and the risk to the Customer.

1.2 Without limiting clause 1.1, the Supplier shall operate an information security management system that meets [[ISO/IEC 27001:2022 / the Customer's Supplier Security Requirements in Schedule X]], and shall comply with the Customer's security policies listed in Schedule [[X]] when working on the Customer's premises or systems.

1.3 The Supplier shall encrypt the Customer's data in transit over public networks and at rest, using [[industry-standard algorithms and key lengths]], and shall keep the Customer's data logically separated from the data of its other customers.

1.4 The Supplier shall not reduce the overall level of security of the Services during the term.

Negotiation notes

• Pushback: 'We follow our own standards, not yours.' Fallback: accept their certified standard in place of your schedule, if the certificate's scope covers the service you buy.
• Hold firm: clause 1.4 (no reduction in security during the term). Without it, the assessment that approved the supplier stops describing it.
• Liability: a general cap on the supplier's liability usually covers a breach of these clauses. Whether a higher or separate cap applies to a data breach or a breach of confidentiality is for Legal to decide. Where the cap is left as it is, record that as an exception, because it changes what the supplier's residual risk is worth.

CL-02 Certification and independent assurance

Clause text — 2. Certification and independent assurance

2.1 The Supplier shall hold, for the whole term, [[an ISO/IEC 27001 certification / an independent assurance report]] whose scope covers the Services, issued by [[an accredited certification body / an independent auditor]].

2.2 The Supplier shall provide the current certificate or report, and its scope or statement of applicability, on signature and within [[30]] calendar days of each renewal or reissue, and shall tell the Customer within [[10]] working days if the certificate is suspended, withdrawn or reduced in scope, or the report is qualified.

2.3 Where the certificate or report does not cover a part of the Services, the Supplier shall give the Customer equivalent evidence for that part on request.

Negotiation notes

• Pushback: 'Our report is confidential.' Fallback: sign the supplier's non-disclosure agreement for the report; do not accept a marketing summary in its place.
• Check: the scope. A certificate for the supplier's head office says nothing about the data centre that runs your service (TP-04).

CL-03 Right to audit and access

Clause text — 3. Right to audit and access

3.1 The Supplier shall allow the Customer, its auditors and any competent authority with jurisdiction over the Customer to audit and inspect the Supplier's compliance with this Agreement, including its premises, systems, records and personnel involved in the Services, on [[30]] calendar days' notice, or on [[2]] working days' notice after a Security Incident or where a competent authority requires it.

3.2 The Customer shall not carry out more than [[one]] audit in any 12 months except after a Security Incident, on a regulator's request, or where a previous audit found a material failure.

3.3 The Customer may first ask for the Supplier's current certification or independent report (clause 2), and shall rely on it where it covers the matter to be audited.

3.4 Each party bears its own costs, unless the audit finds a material breach, when the Supplier bears the reasonable costs of the audit.

DORA variant — use in place of paragraphs 3.1 to 3.3 for an ICT service supporting a critical or important function of a DORA financial entity

3D.1 The Customer, its auditors or any third party it appoints, and any competent authority with jurisdiction over the Customer, shall have unrestricted rights of access, inspection and audit in respect of the Services, and the right to take copies of relevant documentation on site if it is critical to the Supplier's operations. No other term of this Agreement, and no implementation policy of the Supplier, shall impede or limit the effective exercise of those rights.

3D.2 The Supplier shall cooperate fully during on-site inspections and audits carried out by competent authorities, the Lead Overseer, the Customer or a third party the Customer appoints.

3D.3 The Supplier shall give the Customer details of the scope, the procedures to be followed and the frequency of such inspections and audits.

3D.4 If the exercise of those rights would affect the rights of another client of the Supplier, the Customer may agree with the Supplier alternative assurance levels. Such an agreement does not limit the rights of a competent authority. Paragraph 3.4 applies to costs.

Negotiation notes

• Pushback: 'No on-site audits; we serve thousands of customers.' Fallback (outside DORA, and for DORA ICT services that do not support a critical or important function): a document-based audit, with the right to go on site only after an incident or a material finding. Pooled audits with other customers are a reasonable compromise.
• DORA critical or important functions: use paragraphs 3D.1 to 3D.4. Article 30(3)(e)(i) asks for unrestricted rights of access, inspection and audit, whose effective exercise is not impeded or limited by other contractual arrangements or implementation policies. Do not use the limit of one audit in 12 months (3.2) or the duty to rely on the supplier's certificate (3.3) in such a contract. The Article lets the parties agree alternative assurance levels only where another client's rights are affected (Article 30(3)(e)(ii)), which is 3D.4.
• Microenterprise: the last subparagraph of Article 30(3) lets a financial entity that is a microenterprise agree that its rights of access, inspection and audit are delegated to an independent third party appointed by the provider, with a right to ask that third party for information and assurance at any time. Ask Legal before using it.
• Hold firm (regulated entities): access and audit rights for the competent authority.

CL-04 Sub-processors and subcontracting

Clause text — 4. Sub-processors and subcontracting

4.1 The Supplier shall not subcontract any part of the Services, or engage any sub-processor to process the Customer's personal data, without the Customer's prior written authorisation, which is [[specific to each subcontractor or sub-processor / general, in which case clause 4.2 applies]]. The subcontractors and sub-processors authorised on signature are listed in Schedule [[X]]. For an ICT service supporting a critical or important function of a DORA financial entity, Schedule [[X]] also states whether subcontracting of the service, or of material parts of it, is permitted and the conditions that apply.

4.2 The Supplier shall give the Customer at least [[30]] calendar days' written notice of any intended addition or replacement of a subcontractor or sub-processor, with its name, location and the services it will provide. The Customer may object on reasonable security or data protection grounds within that period; if the parties cannot agree, the Customer may terminate the affected Services without penalty.

4.3 The Supplier shall impose on each subcontractor and sub-processor security and data protection obligations no less protective than those in this Agreement, and remains fully liable to the Customer for their performance.

Negotiation notes

• Pushback: 'We give general authorisation and publish changes on our website.' Fallback: general written authorisation is allowed under GDPR Article 28(2), but only with advance notice to you of each intended addition or replacement and a chance to object (4.2); watching a web page is not notice. For a DORA critical or important function, ask Legal whether general authorisation meets the conditions you have set for subcontracting.
• Hold firm: 4.3, flow-down and full liability (GDPR Article 28(4)). Without it, a breach at a sub-processor is nobody's contractual problem.

CL-05 Locations of service and data

Clause text — 5. Locations of service and data

5.1 The Supplier shall provide the Services, and store and process the Customer's data, only in the locations listed in Schedule [[X]] ([[countries or regions, and data centres where relevant]]).

5.2 The Supplier shall give the Customer at least [[60]] calendar days' written notice before changing any of those locations, and shall not transfer the Customer's personal data outside [[the EEA / the UK]] except under a transfer mechanism permitted by data protection law and approved in writing by the Customer.

Negotiation notes

• Pushback: 'Our support staff work from anywhere.' Fallback: list the countries remote support is given from, separately from where data is stored.

CL-06 Data protection: processor terms

Clause text — 6. Data protection: processor terms

6.1 The Supplier shall process the Customer's personal data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country or an international organisation, and including those in Schedule [[X]] (subject matter, duration, nature and purpose of the processing, types of personal data and categories of data subjects), unless required to do otherwise by law, in which case it shall tell the Customer first unless the law forbids it.

6.2 The Supplier shall ensure that everyone it authorises to process the Customer's personal data is bound by a duty of confidentiality.

6.3 The Supplier shall take the security measures in clause 1 and Schedule [[X]], and shall assist the Customer, taking into account the nature of the processing and the information available to it, in meeting the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation.

6.4 The Supplier shall assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights, and shall pass any such request it receives to the Customer within [[5]] working days.

6.5 The Supplier shall make available to the Customer all information necessary to demonstrate compliance with this clause, and shall tell the Customer immediately if, in its opinion, an instruction infringes data protection law.

6.6 Sub-processors are governed by clause 4; return and deletion by clause 13; audits by clause 3.

Negotiation notes

• Pushback: 'Sign our data processing agreement instead.' Fallback: acceptable if it covers every point in the GDPR Article 28(3) table in this library. Check it against the table, not against its title.
• Check with your Data Protection Officer: whether the supplier is really a processor. A supplier deciding the purposes of processing itself is a controller, and these terms do not fit.

CL-07 Security incident notification

Clause text — 7. Security incident notification

7.1 The Supplier shall notify the Customer's security contact in Schedule [[X]] without undue delay, and in any event within [[24]] hours of becoming aware, of any actual or reasonably suspected Security Incident affecting the Customer's data, the Services or the Supplier's systems used to provide them.

7.2 The notification shall state, as far as known: what happened and when; the data, systems and services affected; the likely consequences; the measures taken or proposed; and a named contact. The Supplier shall send updates at least every [[24]] hours until the incident is closed, and a written report of its cause and the actions taken within [[10]] working days of closure.

7.3 'Security Incident' means any event that compromises, or is reasonably likely to compromise, the confidentiality, integrity or availability of the Customer's data or the Services, including a personal data breach.

Negotiation notes

• Pushback: '72 hours, as GDPR allows.' Hold firm: GDPR gives the controller 72 hours to notify the authority, counted from when the controller becomes aware, which is usually when the processor tells it. Your clocks start at the notice, so a slow notice does not use up your time, but every hour the supplier waits is an hour nobody acts, and an authority will ask why the breach took so long to reach you. NIS2 and contract notices have shorter clocks of their own. Accept an initial notice within the window with details to follow.
• Pushback: 'Only confirmed incidents.' Fallback: confirmed incidents, plus suspected incidents that affect your data.

CL-08 Vulnerability management

Clause text — 8. Vulnerability management

8.1 The Supplier shall identify and remediate vulnerabilities in the systems, software and components used to provide the Services, and shall apply the security patch for each vulnerability, or an effective mitigation, within these periods counted from the patch's release: for a vulnerability known to be exploited, or with public exploit code and rated high or critical on a system reachable from the internet, a mitigation within [[72]] hours and the patch within [[7]] calendar days; for any other vulnerability rated critical or high on a system reachable from the internet, within [[14]] calendar days; for other critical or high vulnerabilities, within [[30]] calendar days.

8.2 The Supplier shall tell the Customer within [[2]] working days of becoming aware of a critical vulnerability that affects the Services and cannot be fixed within the period in clause 8.1, with the mitigation it has applied.

8.3 Where the Supplier provides software to the Customer, it shall provide security updates for the supported versions for the term, and shall give at least [[12]] months' notice of the end of support for any version in use by the Customer.

8.4 Software, firmware or components that the Supplier provides to the Customer shall be developed under a documented secure development process. On request the Supplier shall give the Customer a list of the third-party and open-source components in them (a software bill of materials) and shall tell the Customer of a vulnerability in any listed component that affects the Customer.

Negotiation notes

• Drafting note (8.1): the periods copy the Vulnerability & Exposure Management Standard's deadlines for the same priorities, so a supplier is held to what you hold yourself to. They count from the patch's release, as the supplier cannot know your detection date. Ask for the mitigation, not only the patch, in the first tier.
• Pushback: 'We patch according to our own risk assessment.' Fallback: accept their timescales if they are no longer than yours and they will report exceptions.
• Software the supplier provides (8.4): ask for the list of components only where the Customer runs the software itself. A hosted service has no list to hand over, but the supplier can still say how it finds vulnerable components.

CL-09 Access control and multi-factor authentication for supplier staff

Clause text — 9. Access control and multi-factor authentication for supplier staff

9.1 The Supplier shall ensure that only named personnel who need access to perform the Services have access to the Customer's systems and data, with the minimum privileges required, and shall keep a list of them available to the Customer on request.

9.2 All remote access by the Supplier to the Customer's systems, and all access to systems holding the Customer's data, shall use multi-factor authentication and individual accounts. Shared or generic accounts are not permitted.

9.3 The Supplier shall remove access within [[1]] working day of a person leaving the Supplier or no longer needing it, and shall review access rights at least every [[6]] months.

9.4 Privileged access shall be logged, and the logs kept for at least [[12]] months and provided to the Customer on request.

Negotiation notes

• Pushback: 'Our support tool does not support multi-factor authentication.' Hold firm: this is the gap behind many supplier-borne breaches. If it cannot be closed before signature, record it as a finding with a deadline (clause 19) or as an exception under the Security Exception & Waiver Standard (P02), not as silence.

CL-10 Business continuity and disaster recovery

Clause text — 10. Business continuity and disaster recovery

10.1 The Supplier shall maintain, test at least [[annually]] and keep up to date business continuity and disaster recovery plans for the Services, designed to restore the Services within a recovery time of [[X hours]] and with data loss of no more than [[X hours]].

10.2 The Supplier shall give the Customer a summary of each test and its results within [[30]] calendar days of the test, and shall fix any failure found within a period agreed with the Customer.

10.3 On request, the Supplier shall take part in the Customer's own continuity tests involving the Services.

Negotiation notes

• Check: the recovery targets against your own. A supplier recovering in 72 hours cannot support a service you need back in 24.

CL-11 Cooperation in our incident response

Clause text — 11. Cooperation in our incident response

11.1 The Supplier shall name in Schedule [[X]] a security contact available [[24 hours a day, 7 days a week / during business hours]], and shall keep the Customer informed of any change.

11.2 When an incident affects the Customer's data or the Services, whether it starts at the Supplier or at the Customer, the Supplier shall [[at no additional charge / at the rates in Schedule X]]: take part in the Customer's incident response as reasonably requested; preserve and provide logs and other evidence; and support the Customer's notifications to regulators, customers and data subjects.

11.3 The Supplier shall take part in the Customer's incident response exercises involving the Services at least [[once every 12 months]].

Negotiation notes

• Pushback: 'Assistance is chargeable.' Fallback: free for incidents that start at the supplier; at agreed rates for incidents that start with you.

CL-12 Penetration testing and security testing

Clause text — 12. Penetration testing and security testing

12.1 The Supplier shall have the systems used to provide the Services tested by an independent, qualified tester at least every [[12]] months and after any significant change, and shall provide the Customer with a summary of the findings and the remediation plan within [[30]] calendar days of the report.

12.2 The Supplier shall fix critical and high findings from such tests within the periods in clause 8.1.

12.3 The Supplier shall take part in, and cooperate with, security testing of the Customer's systems that involves the Services, including threat-led penetration testing and testing required by a competent authority, subject to reasonable notice and agreed rules of engagement.

12.4 The Customer shall not test the Supplier's systems without the Supplier's written consent.

Negotiation notes

• Pushback: 'The full report is confidential.' Fallback: an executive summary with the count and severity of findings and their status is enough for Tier 1 evidence; the full report can be seen under a non-disclosure agreement.

CL-13 Data return and deletion

Clause text — 13. Data return and deletion

13.1 On termination or expiry, or earlier on the Customer's written request, the Supplier shall, at the Customer's choice, return all the Customer's data in [[a commonly used, machine-readable format agreed in Schedule X]] and then delete it, or delete it, within [[30]] calendar days of the Services ending, unless the law requires the Supplier to keep it.

13.2 Deletion includes copies held by subcontractors and sub-processors. Backup copies shall be deleted in the normal backup cycle, within [[90]] calendar days of the Services ending, and protected until then.

13.3 The Supplier shall confirm deletion in writing, signed by an authorised officer, within [[10]] working days of the deletion being complete.

13.4 Where data is returned, the Supplier shall also return or destroy any encryption keys, credentials and devices belonging to the Customer.

13.5 If the Supplier becomes insolvent, enters resolution or discontinues its business operations, the Supplier (and, to the extent the law allows, any insolvency officer or successor) shall keep the Customer's access to its data, and shall allow it to recover and take its data, in [[a commonly used, machine-readable format agreed in Schedule X]], so far as the Services allow. Clauses 13.1 to 13.4 then apply.

Negotiation notes

• Pushback: 'Deletion from backups is impossible.' Fallback: deletion when the backups expire, with the data protected until then (clause 13.2); get the backup retention period in writing.
• Insolvency (13.5): a supplier cannot promise what insolvency law may override. Ask Legal how far the paragraph binds an insolvency officer in the supplier's country, and for a DORA financial entity consider regular exports of the data (CL-21, 21.3) so that it does not depend on 13.5.

CL-14 Exit and transition assistance

Clause text — 14. Exit and transition assistance

14.1 The Supplier shall maintain an exit plan for the Services, agreed with the Customer within [[90]] calendar days of signature and reviewed [[annually]], covering data return, removal of access, the knowledge and documentation to be handed over, and a transition timetable.

14.2 On termination for any reason, the Supplier shall continue to provide the Services, on the terms of this Agreement, for a transition period of up to [[6]] months at the Customer's request, and shall cooperate with the Customer and any replacement supplier to transfer the Services in an orderly way.

14.3 Transition assistance beyond continued provision of the Services is charged at the rates in Schedule [[X]].

Negotiation notes

• Pushback: 'We cannot commit to a transition period if you terminate for our breach.' Hold firm: that is exactly when you will need it most.

CL-15 Termination rights for security reasons

Clause text — 15. Termination rights for security reasons

15.1 The Customer may terminate this Agreement, in whole or in part, on written notice and without penalty if: the Supplier commits a material breach, or repeated breaches, of its security obligations under clauses [[1, 6, 7, 8, 9 or 13]]; a Security Incident at the Supplier causes material harm to the Customer; the Supplier fails to remedy a High finding by its agreed deadline under clause 19; or a competent authority requires the Customer to end the arrangement.

15.2 Termination under this clause does not affect the Customer's rights under clauses 13 and 14.

15.3 Where either party may end this Agreement otherwise than under clause 15.1, the minimum notice is [[X months]] for the Supplier and [[X months]] for the Customer, and the Supplier shall not end or suspend the Services before that notice expires.

Negotiation notes

• Pushback: 'Termination only after a cure period.' Fallback: a cure period of [[30]] calendar days for breaches that can be remedied, none for a regulator's requirement or a serious incident.
• Notice periods (15.3): Article 30(2)(h) of DORA asks for termination rights and related minimum notice periods, 'in accordance with the expectations of competent authorities and resolution authorities'. Take the periods from those expectations and from your exit plan (CL-14): they must be long enough to move the service.

CL-16 Security awareness and training of supplier staff

Clause text — 16. Security awareness and training of supplier staff

16.1 The Supplier shall ensure that all personnel involved in the Services receive information security awareness training on joining and at least every [[12]] months, and shall keep records of that training available to the Customer on request.

16.2 Where the Customer so requires, the Supplier's personnel with access to the Customer's systems shall take part in the Customer's security awareness and training programmes.

16.3 The Supplier shall carry out background checks, as far as the law allows and in proportion to the role, on personnel who will have access to the Customer's systems or data before they are given that access.

Negotiation notes

• Usually accepted. Where the supplier resists 16.2, limit it to personnel with privileged access. Screening (16.3) is bound by local law, so accept the checks the supplier's country allows.

CL-17 Cooperation with competent authorities

Clause text — 17. Cooperation with competent authorities

17.1 The Supplier shall cooperate fully with any competent authority and any resolution authority with jurisdiction over the Customer, and with any person appointed by either, including by giving access, information and assistance as the authority requires.

17.2 The Supplier shall tell the Customer promptly, unless the law forbids it, of any request from a competent authority concerning the Services.

Negotiation notes

• Hold firm (regulated entities): this is not a commercial point; the regulator can require it.

CL-18 Service levels and security reporting

Clause text — 18. Service levels and security reporting

18.1 The Supplier shall meet the service levels in Schedule [[X]], including availability of [[99.9]]% per calendar month, incident response and resolution times, and recovery targets, and shall report performance against them every [[month]].

18.2 The Supplier shall give the Customer a security report every [[quarter]] covering: Security Incidents; open critical and high vulnerabilities; progress on findings under clause 19; changes to subcontractors, sub-processors and locations; and the status of certifications.

18.3 Where a service level is missed, the Supplier shall give the Customer a corrective plan within [[10]] working days.

Negotiation notes

• Pushback: 'Standard service levels only.' Fallback: standard service levels plus the quarterly security report; the report costs the supplier little and tells you most.

CL-19 Remediation of assessment findings

Clause text — 19. Remediation of assessment findings

19.1 The Supplier shall remedy the findings listed in Schedule [[X]] by the deadlines stated there, and shall report progress to the Customer every [[month]] until each is closed.

19.2 For findings from later assessments, the Supplier shall agree a remediation plan within [[20]] working days of the Customer's report, with deadlines of no more than [[90]] calendar days for High findings and [[180]] calendar days for Medium findings, counted from the date of the report.

19.3 A High finding not remedied by its deadline is a material breach for the purposes of clause 15.

Negotiation notes

• Pushback: 'We will fix it in our next release.' Fallback: agree the date, but put it in the schedule. A finding without a contractual date is not a condition.

CL-20 Notice of material changes

Clause text — 20. Notice of material changes

20.1 The Supplier shall give the Customer at least [[30]] calendar days' written notice of any change that may materially affect the security, resilience or performance of the Services or its ability to meet this Agreement, including: a change of control; a material change to the systems, architecture or security measures; the loss of a certification; and material financial difficulty.

20.2 Where notice in advance is not possible, the Supplier shall give it as soon as it becomes aware of the change.

20.3 The Supplier shall, on request, give the Customer evidence of its financial standing, and shall keep in force throughout the term [[cyber liability and professional indemnity]] insurance of at least [[the amount in Schedule X]], giving the Customer a certificate of cover on signature and on each renewal.

Negotiation notes

• Pushback: 'We cannot disclose a change of control before it is public.' Fallback: notice as soon as the law allows.
• Insurance and financial standing (20.3): a supplier that fails financially can no longer fix a finding or restore a service. Ask for the certificate of cover, and read what it excludes.

CL-21 Cloud services

Clause text — 21. Cloud services

21.1 The Supplier shall document which security controls it operates and which the Customer must configure or operate (the shared responsibility), and shall keep that document current.

21.2 The Supplier shall make available to the Customer the logs of access to and activity in the Customer's environment for at least [[90]] calendar days, and shall support the Customer's use of [[multi-factor authentication / single sign-on]] for all users.

21.3 The Supplier shall give the Customer the means to export all its data in a usable format at any time during the term, not only at exit.

Negotiation notes

• Large cloud providers rarely negotiate. Map their standard terms against this clause and the others for the tier, record the gaps, and record each as an exception (P02); where a gap leaves the provider outside appetite, the risk approver (P05) also signs it. Configure your own side of the shared responsibility; most cloud breaches start there.

Worked examples

Two EXAMPLE suppliers of the distributor used throughout the pack (a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders), as at 30 September 2026 (EXAMPLE; replace with your own date). The distributor is not a financial entity, so the DORA columns do not apply.

Example 1 — SUP-004, conditions from the assessment

SUP-004 (ERP software provider (hosted)) is Tier 1: it supports finance and payroll and warehouse dispatch. It was assessed on 21 April 2026 and the decision was Approve with conditions: proceed; named findings fixed by their deadlines, recorded as conditions in the contract or the register. The findings go into the schedule to CL-19:

• What the contract changes. Without CL-19, F-01 is a request in a report. With it, the deadline of 20 July 2026 is a contract term, and under CL-15 a High finding not remedied by its deadline is grounds for termination without penalty.
• What happens now. F-01 is past its deadline, so under TP-08 it is escalated to the business owner, who decides whether to enforce, agree a new date recorded as an exception under the Security Exception & Waiver Standard, or plan exit (TP-11). The Third-Party Risk Dashboard counts it in TPM-03.
• What the renewal adds. SUP-004 holds personal data for us, so CL-06 applies; F-02 shows why CL-13.3, the signed deletion certificate, belongs in the contract and not only in the questionnaire.

Example 2 — SUP-012, selecting clauses for a new contract

SUP-012 (Payroll bureau) is Tier 1 by service and data (see the Supplier Criticality & Tiering Model), processes staff personal data for us, and is a hosted service. Its assessment is planned for 17 November 2026; the contract is renewed after it.

Negotiating with suppliers

• Start from the tier. A supplier asked for Tier 1 clauses because it is Tier 1 will understand; one asked for everything because it is in the template will not. Say why.
• Know your must-haves. For every supplier that holds our data: incident notification (CL-07), return and deletion of data (CL-13) and, for processors, the processor terms (CL-06). For Tier 1: also access control (CL-09), exit (CL-14) and audit (CL-03).
• Accept equivalent wording. The supplier's own clause is fine if it achieves the same outcome. Compare it with 'What it achieves', not word for word.
• Trade evidence for audit. Outside DORA critical or important functions, a current certification or independent report with the right scope is a fair substitute for on-site audit, except after an incident and for a regulator. In a DORA contract for a critical or important function the customer's rights of access, inspection and audit are not capped or replaced by a certificate; the only give is alternative assurance levels where other clients' rights are affected (CL-03, 3D.4).
• Record what you did not get. A clause given up is a known gap: record it as an exception, co-signed by the risk approver where it leaves the supplier outside appetite (step 7 of 'How to use this library'), and look at it again at the next reassessment (TP-09).

Related documents

Adapting this template

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).

Definitions