A Cyber Assurance Clause Pack for Supplier Contracts

Introduction

A recent report on policing in England and Wales revealed a significant gap: most police supplier contracts lacked ongoing cybersecurity assurance. Many organizations couldn't confirm if suppliers were required to report incidents promptly, and system logs held by suppliers weren't accessible to internal teams. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year, highlighting that police data on supplier systems is a major risk due to lack of monitoring.

This issue isn't confined to policing. Any contract allowing a supplier to handle sensitive data without clear assurance, reporting, and visibility terms leaves you vulnerable to unseen risks. The clause pack below is designed for sourcing and procurement leaders negotiating these agreements. Use it in a security schedule or data protection addendum, and customize it with the provided notes.

Prerequisites

Before integrating this into a contract, ensure you have:

• Criticality Classification complete. Determine which suppliers handle high-sensitivity data like victim or intelligence information. Apply the full pack to the highest classification only.
• A named internal owner for supplier incidents with a 24-hour contact route. A notification clause is ineffective if it lands in a shared inbox.
• A data inventory per supplier: detailing data categories, hosting locations, and applicable Sub-Processor Disclosure.
• Security and legal sign-off on technical annexes. Procurement handles negotiation; security defines "adequate".
• A Right to Audit position agreed internally, specifying audit performers and conditions.

The Clause Pack

Replace bracketed items. Bold labels are internal drafting notes; delete them before issuing.

Clause 1. Security Standard and Ongoing Assurance

1.1 The Supplier shall maintain an information security management system aligned to [ISO 27001 / equivalent named standard] throughout this Agreement and any data retention period.

1.2 The Supplier shall provide evidence of continued conformity [annually / on each renewal of certification], including [certification scope statements, independent test summaries, and a completed SIG Core or equivalent questionnaire].

1.3 The Supplier shall remediate findings rated [high or critical] within [X days] and report remediation status to the Customer on request.

This converts a one-time Pre-Contractual Assessment into a standing obligation, directly addressing the "no ongoing assurance" gap.

Clause 2. Incident Notification

2.1 The Supplier shall notify the Customer's incident contact at [address/phone] without undue delay and within [X hours] of any actual or suspected security incident affecting Customer Data, systems connected to Customer systems, or Services.

2.2 Initial notification shall include: nature of the incident, data and systems affected, containment steps taken, and a named Supplier contact. Updates shall follow every [X hours] until closure.

2.3 "Near misses" involving attempted access to Customer Data or Customer-connected systems shall be reported in a [monthly] summary.

2.4 The Supplier shall not delay notification pending its own investigation.

This sets a defined Notification Timeline and clarifies reporting responsibilities. Clause 2.3 is crucial as near-miss volume signals targeting.

Clause 3. Visibility and Log Access

3.1 The Supplier shall retain security-relevant logs for systems processing Customer Data for at least [X months].

3.2 The Supplier shall provide the Customer with [real-time feeds / API access / on-request extracts within X hours] of logs related to Customer Data access, administrative activity, and authentication events.

3.3 During a security incident, the Supplier shall provide relevant logs and forensic artifacts to the Customer within [X hours] of request.

This addresses the lack of visibility of supplier-held logs. Without it, your monitoring ends at your network boundary.

Clause 4. Right to Audit and Testing

4.1 The Customer, or an independent party it appoints, may audit the Supplier's security controls relevant to the Services on [X days'] notice, and without notice following a security incident.

4.2 The Supplier shall permit [annual] penetration test summaries to be shared and allow the Customer to commission testing of Customer-facing components with prior agreement on scope.

This gives you verification rights beyond self-attestation.

Clause 5. Sub-Outsourcing Clause

5.1 The Supplier shall not sub-outsource processing of Customer Data without prior written consent and shall maintain a current Sub-Processor Disclosure available to the Customer.

5.2 The Supplier shall flow down obligations equivalent to Clauses 1 to 4 and remains liable for sub-contractor performance.

This extends the chain into Fourth and Nth Party Management. Attackers often enter through the weakest link, not the contracted supplier.

Clause 6. Liability and Indemnification

6.1 The Supplier shall indemnify the Customer for losses arising from security incidents caused by the Supplier's or its sub-contractors' breach of this Schedule, subject to [cap / super-cap of X].

6.2 The Supplier shall bear the reasonable costs of incident response, notification, and remediation attributable to such incidents.

Clause 7. Termination Rights and Wind-Down

7.1 The Customer may terminate for material security failure, including repeated failure to meet Clause 2 timelines.

7.2 On termination, the Supplier shall support a Wind-Down Plan including secure return and certified deletion of Customer Data within [X days], and Access Revocation for all Supplier-held credentials.

Customization Tips

Scale by Criticality Classification. For lower classifications, drop Clause 3.2's real-time feeds and keep on-request extracts. For top-tier suppliers handling the most sensitive categories, insist on all seven clauses.

Tune the numbers to your capacity. A 4-hour notification window you can't act on is worse than a 24-hour one you can. Set timelines your incident team can actually staff, then align them with any regulatory clock that applies to you.

Map to your regime. Financial services firms should cross-check against SR 23-4 and the EBA Outsourcing Guidelines. ISO 27036 offers a useful reference structure for supplier relationship security requirements.

Expect pushback on liability. Suppliers resist uncapped exposure. A negotiated super-cap for data breach is a common compromise; decide your floor before you enter the room.

Don't let the sector gap become your gap. The inspectorate criticized national plans for leaving policing and fire services out. If your sector isn't covered by a mandate, the contract is your only enforceable control. Write it as if nothing else will protect you.

Validation Steps

1. Run a notification drill. Ask a supplier to send a test incident notice to your named contact. Measure time to receipt and time to triage.
2. Request a sample log extract under Clause 3 within the stated window. If they can't, you've found a gap before an incident does.
3. Check flow-down. Ask for the Sub-Processor Disclosure and confirm the top three sub-processors have equivalent obligations.
4. Confirm ownership. Verify the named incident contact is current, staffed, and has escalation authority. Review quarterly.
5. Feed results into Continuous Monitoring of Active Arrangements. Track clause compliance on your Performance Scorecard, including SLA Monitoring for notification and remediation timelines.
6. Have legal review the final schedule for enforceability in your jurisdiction.

A contract can't stop an attack. It can make sure you hear about one quickly, see what happened, and hold someone accountable.