Addressing information security within supplier agreements

Why it matters

Verbal assurances from a vendor don't hold up in an incident — contract terms do.

How a self-led small team implements it

For critical vendors, confirm their contract or DPA covers security and breach notification; for the rest, note the gap and move on.

What auditors expect to see

Contract clauses or DPAs referencing security requirements.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities