Supplier Contract Security Checklist

1. Purpose

The Supplier Contract Security Checklist provides a structured process for reviewing security requirements before entering into, renewing, or materially changing a contract with a supplier, vendor, service provider, consultant, cloud provider, SaaS provider, contractor, or other third party.

The objective is to ensure that supplier contracts:

Clearly define the services being provided
Establish appropriate information-security requirements
Protect organizational and customer information
Define confidentiality obligations
Address privacy and personal-data requirements
Define access-control requirements
Establish incident and breach notification obligations
Address subcontractors and subprocessors
Address business continuity and service availability
Define security assurance requirements
Establish data retention, return, and deletion requirements
Define responsibilities of both parties
Provide appropriate rights to review security compliance
Establish secure termination and exit requirements

Core Principle

Identify → Assess → Define → Contract → Approve → Monitor → Review → Exit

2. When to Use

Use this checklist:

Before signing a new supplier contract
Before renewing a supplier contract
When a supplier’s service materially changes
When new information is shared
When new system access is required
When production access is introduced
When personal data is introduced
When a supplier adds a subprocessor
When the supplier changes data location
After a significant security incident
When contractual security requirements change
During periodic supplier reviews

3. Supplier Contract Information

Field	Details
Contract Review ID
Supplier ID
Legal Name
Trading Name
Supplier Type
Service
Business Owner
Supplier Owner
Contract ID
Contract Version
Contract Start Date
Contract End Date
Renewal Date
Reviewer
Security Reviewer
Legal Reviewer
Review Date
Overall Result

4. Supplier Classification

☐ Supplier
☐ Vendor
☐ SaaS Provider
☐ Cloud Provider
☐ Managed Service Provider
☐ IT Service Provider
☐ Consultant
☐ Contractor
☐ Development Partner
☐ Security Provider
☐ Payment Provider
☐ Data Processor
☐ Outsourced Service Provider
☐ Other: ______________________

5. Business and Service Review

Before reviewing security clauses, confirm what the supplier actually provides.

☐ Business purpose documented
☐ Service clearly defined
☐ Deliverables defined
☐ Service scope defined
☐ Business owner identified
☐ Criticality assessed
☐ Dependencies identified
☐ Information involved identified
☐ Systems involved identified
☐ Expected access identified
☐ Service locations identified
☐ Expected contract duration defined

Service Description

6. Supplier Risk Assessment

Confirm that supplier risk has been assessed.

Consider:

Information sensitivity
Personal data
Customer data
Production access
Privileged access
Cloud dependency
Business criticality
Regulatory requirements
Geographic exposure
Subprocessors
Availability dependency
Supplier concentration risk

☐ Supplier risk assessment completed
☐ Risk level documented
☐ Required security controls determined
☐ Risk owner identified
☐ Risk acceptance obtained where required

Risk Level

☐ Low
☐ Medium
☐ High
☐ Critical

7. Contracting Entity Verification

Verify that the contract is with the correct legal entity.

☐ Legal entity verified
☐ Registered name verified
☐ Business address verified
☐ Contracting entity confirmed
☐ Parent/subsidiary relationship reviewed
☐ Authorized signatory verified
☐ Supplier ownership reviewed where relevant
☐ Supplier contact information verified

8. Information Covered by Contract

Identify information the supplier may receive, process, store, or access.

☐ Public information
☐ Internal information
☐ Confidential information
☐ Restricted information
☐ Customer information
☐ Personal data
☐ Financial information
☐ Source code
☐ Intellectual property
☐ Security information
☐ Vulnerability information
☐ Credentials/secrets
☐ Other: ______________________

Information Classification

Highest Classification: ______________________

9. Confidentiality Requirements

Verify that the contract or associated NDA addresses confidentiality.

☐ Confidentiality obligations defined
☐ Confidential information defined
☐ Permitted use defined
☐ Need-to-know principle addressed
☐ Unauthorized disclosure prohibited
☐ Unauthorized use prohibited
☐ Supplier personnel obligations defined
☐ Subcontractor confidentiality requirements defined
☐ Customer information protected
☐ Personal data protected
☐ Source code/IP protected
☐ Security information protected
☐ Confidentiality survives contract termination where required

NDA

☐ Separate NDA
☐ Contract confidentiality clause
☐ Both
☐ Not applicable

Agreement Reference: ______________________

10. Information Security Requirements

The contract should define security requirements proportionate to supplier risk.

☐ Security controls required
☐ Security responsibilities assigned
☐ Information protection requirements defined
☐ Access-control requirements defined
☐ Authentication requirements defined
☐ MFA requirements defined where appropriate
☐ Encryption requirements defined where appropriate
☐ Logging/monitoring requirements defined where appropriate
☐ Vulnerability-management requirements defined
☐ Incident-management requirements defined
☐ Business continuity requirements defined

11. Security Standards and Certifications

Where appropriate, specify required security assurance.

☐ ISO/IEC 27001
☐ SOC 2
☐ PCI DSS
☐ ISO/IEC 27701
☐ ISO/IEC 42001
☐ Independent penetration testing
☐ Independent security assessment
☐ Customer security questionnaire
☐ Other: ______________________

Confirm:

☐ Scope is relevant
☐ Certificate/report is current
☐ Service is covered
☐ Relevant locations are covered
☐ Exceptions are understood

A certification should not automatically be treated as evidence that every contractual security requirement has been satisfied.

12. Access Control Requirements

Where supplier personnel receive access:

☐ Individual accounts required
☐ Shared accounts restricted
☐ Least privilege required
☐ Need-to-know required
☐ MFA required where appropriate
☐ Privileged access separately controlled
☐ Access approval required
☐ Access expiry defined
☐ Periodic access review required
☐ Access revocation requirement defined
☐ Customer-system access controlled
☐ Production access controlled

13. Privileged Access

If supplier personnel receive privileged access:

☐ Business justification required
☐ Named accounts required
☐ MFA required
☐ Access limited to required systems
☐ Logging required
☐ Monitoring required where appropriate
☐ Periodic review required
☐ Temporary access considered
☐ Access revocation requirement defined
☐ Emergency revocation process defined

14. Cloud Security

For cloud suppliers or suppliers managing cloud environments:

☐ Cloud provider identified
☐ Accounts/subscriptions identified
☐ Responsibilities defined
☐ IAM requirements defined
☐ MFA requirements defined
☐ Encryption requirements defined
☐ Logging requirements defined
☐ Monitoring requirements defined
☐ Backup requirements defined
☐ Vulnerability-management requirements defined
☐ Configuration-security requirements defined
☐ Privileged-access requirements defined

15. AWS Contract Security

For an AWS SaaS supplier or supplier managing AWS:

☐ AWS accounts identified
☐ AWS responsibilities defined
☐ IAM requirements defined
☐ MFA requirements defined
☐ Production access controlled
☐ Administrative access controlled
☐ CloudTrail/logging requirements defined
☐ S3/data-access requirements defined
☐ Secrets management requirements defined
☐ Key-management requirements defined
☐ Security monitoring defined
☐ Access-review requirements defined

16. Personal Data and Privacy

If the supplier processes personal data:

☐ Personal data identified
☐ Processing purpose defined
☐ Data categories identified
☐ Data subjects identified
☐ Processing instructions defined
☐ Data-processing agreement required
☐ Data controller/processor responsibilities defined
☐ Subprocessors addressed
☐ Data location defined
☐ International transfers addressed
☐ Retention requirements defined
☐ Deletion requirements defined
☐ Data-subject requirements addressed where applicable
☐ Privacy incident requirements defined

17. Data Processing Agreement

Where applicable:

☐ DPA completed
☐ Processing scope defined
☐ Processing instructions defined
☐ Security measures defined
☐ Confidentiality obligations defined
☐ Subprocessor requirements defined
☐ Data breach notification defined
☐ Data return/deletion defined
☐ Audit/assurance requirements defined
☐ International transfer requirements addressed

DPA Reference: ______________________

18. Customer Information

If customer information is shared:

☐ Customer requirements reviewed
☐ Customer contractual obligations identified
☐ Data minimization required
☐ Access restrictions defined
☐ Encryption requirements reviewed
☐ Data transfer requirements defined
☐ Data retention defined
☐ Data deletion/return defined
☐ Incident notification requirements defined
☐ Customer notification responsibilities defined where applicable

19. Information Transfer

Define how information may be transferred.

☐ Approved transfer mechanisms
☐ Encryption in transit
☐ Secure file transfer
☐ Recipient verification
☐ Access-controlled sharing
☐ API security
☐ Transfer logging where appropriate
☐ Data minimization
☐ Restrictions on personal email
☐ Restrictions on unapproved cloud storage

20. Encryption

Where appropriate, define:

☐ Encryption in transit
☐ Encryption at rest
☐ Key management
☐ Key access restrictions
☐ Key rotation
☐ Certificate management
☐ Secure cryptographic mechanisms

Requirements should reflect the sensitivity of the information and risk of the service.

21. Vulnerability Management

Where relevant, require the supplier to:

☐ Identify vulnerabilities
☐ Perform vulnerability scanning
☐ Perform security testing
☐ Prioritize vulnerabilities
☐ Remediate vulnerabilities
☐ Track remediation
☐ Retest fixes
☐ Communicate significant vulnerabilities
☐ Support emergency vulnerability response

Vulnerability Notification Requirement

22. Application Security

For software development or SaaS suppliers:

☐ Secure development practices
☐ Secure coding
☐ Code review
☐ Dependency management
☐ Security testing
☐ Vulnerability management
☐ Penetration testing where appropriate
☐ Release controls
☐ Security defect management
☐ Production deployment controls
☐ Source-code protection

23. Open-Source and Third-Party Components

For software suppliers:

☐ Third-party components managed
☐ Open-source licenses managed
☐ Vulnerability monitoring performed
☐ Software dependencies managed
☐ SBOM requirements considered
☐ Critical component vulnerabilities communicated
☐ Software supply-chain security addressed

24. Security Incident Requirements

The contract should define:

☐ Security incident definition
☐ Supplier incident responsibilities
☐ Incident reporting contact
☐ Notification timeframe
☐ Escalation requirements
☐ Evidence preservation
☐ Investigation cooperation
☐ Root-cause analysis
☐ Corrective action
☐ Customer notification responsibilities where applicable
☐ Regulatory notification responsibilities where applicable

Supplier Notification Requirement

Initial Notification: ______________________

Escalation: ______________________

Contact: ______________________

25. Data Breach Requirements

If personal/customer data is involved:

☐ Breach definition established
☐ Notification requirement established
☐ Notification timeframe established
☐ Required information defined
☐ Investigation cooperation defined
☐ Evidence preservation defined
☐ Regulatory cooperation defined
☐ Customer communication responsibilities defined
☐ Remediation requirements defined

26. Business Continuity

For important or critical suppliers:

☐ Business continuity requirements defined
☐ Disaster recovery requirements defined
☐ Backup requirements defined
☐ Recovery objectives defined
☐ RTO defined where appropriate
☐ RPO defined where appropriate
☐ Recovery testing required
☐ Service outage notification defined
☐ Alternative arrangements considered
☐ Critical dependency identified

RTO

RPO

27. Service Availability

Where applicable:

☐ SLA defined
☐ Availability requirement defined
☐ Planned maintenance requirements defined
☐ Outage notification defined
☐ Incident escalation defined
☐ Service recovery requirements defined
☐ Service credits/remedies defined where commercially appropriate

28. Supplier Personnel Security

Where relevant:

☐ Personnel screening requirements
☐ Confidentiality requirements
☐ Security awareness requirements
☐ Role-based training
☐ Access restrictions
☐ Personnel change notification
☐ Offboarding requirements
☐ Access revocation requirements

The requirements should be proportionate to the supplier’s role and applicable law.

29. Subcontractors and Subprocessors

Determine whether the supplier can use other organizations.

☐ Subcontractors identified
☐ Subprocessors identified
☐ Approval requirements defined
☐ Change notification required
☐ Security requirements flow down
☐ Confidentiality requirements flow down
☐ Incident requirements flow down
☐ Privacy requirements flow down
☐ Data-location requirements flow down
☐ Customer requirements flow down where applicable

Subprocessor Approval Model

☐ Prior written approval
☐ General approval with notification
☐ Contractual notification
☐ Other: ______________________

30. Data Location

Define where information may be stored and processed.

Location	Activity	Information	Approved?	Requirement

Review:

☐ Primary storage location
☐ Backup location
☐ Processing location
☐ Disaster-recovery location
☐ Subprocessor location
☐ International transfer requirements

31. Data Retention

Define:

☐ Retention period
☐ Business requirements
☐ Legal/regulatory requirements
☐ Customer requirements
☐ Backup retention
☐ Archive retention
☐ Temporary data handling
☐ End-of-contract requirements

32. Data Return and Deletion

The contract should address what happens when the service ends.

☐ Data return required
☐ Data deletion required
☐ Backup deletion addressed where practical
☐ Deletion timeframe defined
☐ Deletion evidence required where appropriate
☐ Customer data addressed
☐ Personal data addressed
☐ Supplier copies addressed
☐ Subprocessor copies addressed

Completion Evidence

33. Security Assurance and Audit Rights

Determine how security compliance will be verified.

☐ Security questionnaire
☐ Security certification
☐ SOC report
☐ Penetration-test summary
☐ Independent assessment
☐ Supplier security review
☐ Right to request evidence
☐ Right to audit where appropriate
☐ Corrective-action requirements
☐ Security review frequency defined

Audit rights should be proportionate to supplier risk and commercially/legal appropriate.

34. Security Assessment Rights

Where appropriate, contractually establish the supplier’s obligation to cooperate with:

☐ Security assessments
☐ Risk assessments
☐ Compliance assessments
☐ Customer audits
☐ Regulatory requests
☐ Incident investigations
☐ Corrective-action verification

35. Regulatory and Legal Requirements

Identify requirements applicable to the relationship.

☐ Privacy laws
☐ Industry regulations
☐ Customer contractual requirements
☐ Information-security obligations
☐ Data-location requirements
☐ Records-retention requirements
☐ Regulatory reporting
☐ Intellectual-property requirements
☐ Export/import restrictions where applicable
☐ Other: ______________________

36. Intellectual Property

For software, development, consulting, or content suppliers:

☐ IP ownership defined
☐ Work-product ownership defined
☐ Source-code ownership defined
☐ License rights defined
☐ Restrictions on reuse defined
☐ Third-party IP addressed
☐ Open-source requirements addressed
☐ Confidential information protected
☐ IP returned/transferred at termination

37. AI and Generative AI

If the supplier uses AI:

☐ AI use disclosed
☐ AI provider identified where relevant
☐ Customer-data restrictions defined
☐ Personal-data restrictions defined
☐ Confidential-data restrictions defined
☐ Source-code restrictions defined
☐ Training/use of submitted data addressed
☐ Data retention addressed
☐ AI subprocessors identified
☐ Human oversight requirements addressed where appropriate
☐ AI security requirements defined

38. Security Logging and Monitoring

Where applicable:

☐ Authentication logging
☐ Privileged activity logging
☐ Administrative activity logging
☐ Security event logging
☐ Application logging
☐ Access logging
☐ Log retention defined
☐ Log protection defined
☐ Security monitoring defined
☐ Alert escalation defined

39. Security Change Notification

Require the supplier to notify the organization of significant changes where appropriate.

☐ Ownership change
☐ Service change
☐ Security architecture change
☐ Data-location change
☐ Subprocessor change
☐ Material security-control change
☐ Major vulnerability
☐ Major security incident
☐ Certification loss/expiry
☐ Significant service outage

Notification Requirement

40. Supplier Security Performance

Where appropriate, define measurable requirements.

Requirement	Target	Measurement	Frequency	Owner
Availability
Incident Notification
Vulnerability Remediation
Security Assurance
Backup/Recovery

41. Contract Termination

Review security requirements for termination.

☐ Termination rights defined
☐ Security breach termination rights considered
☐ Data return defined
☐ Data deletion defined
☐ Access revocation defined
☐ Asset return defined
☐ Confidentiality survives termination
☐ Subprocessor access terminated
☐ Credentials addressed
☐ Exit assistance defined where appropriate

42. Exit and Transition

For critical suppliers:

☐ Exit plan required
☐ Data migration requirements defined
☐ Data export format defined
☐ Migration assistance defined
☐ Knowledge transfer defined
☐ Service transition defined
☐ Alternative supplier considered
☐ Exit timeframe defined
☐ Access revocation defined
☐ Data deletion verification defined

43. Supplier Liability and Security Responsibility

With Legal review, consider whether the contract appropriately addresses:

☐ Security responsibilities
☐ Confidentiality responsibilities
☐ Data protection responsibilities
☐ Incident-related responsibilities
☐ Breach responsibilities
☐ Regulatory cooperation
☐ Indemnification where appropriate
☐ Liability limitations
☐ Insurance requirements where appropriate

Security requirements should be reviewed with Legal rather than treated as purely technical clauses.

44. Insurance

For higher-risk suppliers, consider:

☐ Cyber insurance
☐ Professional liability insurance
☐ Errors and omissions insurance
☐ General liability insurance
☐ Coverage limits reviewed
☐ Certificate of insurance obtained where required

45. Contractual Security Responsibility Matrix

Requirement	Organization	Supplier	Shared
Access Management
Data Protection
Incident Response
Vulnerability Management
Backup
Business Continuity
Security Monitoring
Subprocessor Management
Data Deletion
Security Testing

Clearly assigning responsibilities helps prevent security gaps caused by assumptions.

46. Contract Security Gap Assessment

Record missing or inadequate security provisions.

Gap ID	Contract Area	Gap	Risk	Required Action	Owner	Due Date

47. Risk Treatment

For each significant contractual gap:

☐ Reduce
☐ Avoid
☐ Transfer/Share
☐ Accept

Risk Treatment

Risk	Treatment	Control/Action	Risk Owner	Due Date	Status

Risk acceptance should follow the organization’s approved risk-acceptance process.

48. Contract Review Approvals