Your security is only as strong as the weakest supplier with access to your systems or data. A growing share of serious breaches now arrive through third parties — software vendors, cloud services, outsourced IT and other partners. Technical controls matter, but the contract is where you set enforceable expectations and allocate risk. This guide sets out the security clauses every vendor agreement should contain.
Why third-party risk deserves attention
When you hand data or system access to a supplier, you extend your attack surface to their environment — and often to their suppliers in turn. Regulators increasingly expect organisations to manage this chain actively, and frameworks such as NIS2 and DORA make supply-chain security an explicit duty for those they cover. Even where a specific regime does not apply, sound contracting is simply good risk management.
The clauses that matter
Security standards and measures
Require the supplier to maintain appropriate technical and organisational security measures, ideally mapped to a recognised standard such as ISO/IEC 27001 or a SOC 2 report. Vague promises to keep data “secure” are hard to enforce; specific, referenced obligations are not.
Breach notification
Set a clear, short deadline for the supplier to notify you of a security incident affecting your data or services — measured in hours, not days — so you can meet your own regulatory notification duties, including the GDPR’s 72-hour rule where personal data is involved.
Audit and assurance rights
Reserve the right to audit the supplier’s security, or to receive independent audit reports and certifications on a regular basis. This lets you verify rather than simply trust.
Sub-contractors and the onward chain
Control the use of sub-processors: require notice or approval, and ensure your security terms flow down to anyone the supplier engages. A gap further down the chain is still your problem.
Data location, return and deletion
Specify where data may be stored and processed, and set clear obligations to return or securely delete it at the end of the relationship. Weak exit terms leave your data lingering in systems you no longer control.
Cooperation, liability and insurance
Require the supplier to cooperate during incident response and investigations, address liability and indemnities for security failures, and consider requiring appropriate cyber insurance. Where personal data is processed, a GDPR-compliant data processing agreement is mandatory, not optional.
Beyond the contract
Paper protections work only alongside real diligence. Assess a supplier’s security before you sign, keep an inventory of who has access to what, monitor critical vendors over the life of the relationship, and plan for how you would respond if a key supplier were compromised or failed. Contracts set the floor; active management keeps you above it.
How Lawgent can help
Lawgent helps businesses build supply-chain security and data-protection terms into their contracts and vendor processes, and reviews existing agreements for gaps. Contact us to strengthen how you manage third-party cyber risk.
