15.4
IG2 IG3

Ensure Service Provider Contracts Include Security Requirements

Asset Type: N/A
Security Function: Protect

Description

Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal commitments. These security requirements must be consistent with the enterprise’s service provider management policy. Review service provider contracts annually to ensure contracts are not missing security requirements.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Identify all data requiring encryption
7
Select approved encryption algorithms and key lengths (AES-256)
8
Deploy encryption solution and verify data protection
9
Establish key management procedures
10
Develop incident response plan and playbooks
11
Define roles, escalation paths, and communication channels
12
Conduct tabletop exercise to validate plan
13
Establish post-incident review process
14
Draft policy/procedure document
15
Obtain stakeholder review and approval
16
Communicate to affected personnel
17
Schedule periodic review and updates
18
Inventory all third-party service providers
19
Classify third parties by risk level
20
Conduct security assessments of critical vendors
21
Include security requirements in contracts

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Service Provider Data Breach Without Contractual Notification Obligation

Confidentiality

A service provider suffers a breach affecting enterprise data but delays disclosure for months because no contractual requirement mandates timely breach notification, leaving the organization unable to respond.

Provider Fails to Encrypt Data Due to Absent Contractual Requirement

Confidentiality

A cloud service provider stores enterprise data unencrypted because the contract contains no security requirements mandating encryption, and the data is subsequently exposed in a misconfiguration incident.

Sensitive Data Retained by Provider After Contract Termination

Confidentiality

A former service provider retains copies of sensitive enterprise data indefinitely because the original contract included no data disposal commitments, creating ongoing exposure risk.

Vulnerabilities (When Safeguard Absent)

Service Provider Contracts Lack Security Requirements

Without contractual security requirements, providers have no legal obligation to implement encryption, notify the enterprise of breaches, maintain minimum security programs, or securely dispose of data.

No Contractual Basis for Security Audits or Compliance Verification

Absence of security clauses in contracts means the organization has no right to audit, assess, or verify the service provider's security posture or compliance with expected standards.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Encryption configuration evidence (disk encryption status, TLS settings) Scanned monthly
Document Key management procedures and key rotation records Reviewed annually
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually