The Contract Is Part of the Control: Five Supplier Terms for UK Boards
Photo: Foreign, Commonwealth & Development Office, CC BY 2.0, via Wikimedia Commons
Supplier contracts are usually negotiated by procurement and reviewed by legal, while security teams assess a different document. The gap between those conversations is where resilience leaks. A supplier can hold a valid certificate and still leave the customer unable to meet its own regulatory clock, evidence its controls or retrieve its data on exit.
The following five clauses do not guarantee safety. They do, however, determine whether the board can act when something goes wrong. They are not legal advice; they are the questions directors should put before signature.
1. Breach notification: from 'promptly' to a clock
Most contracts say 'promptly' or 'without undue delay'. That is not an operating instruction. A serious supplier incident can affect the customer's own regulatory obligations, customer communications and insurance position. The clause should define a reportable incident, set an initial notification deadline, require updates and address cooperation and costs.
Example language: 'Supplier shall notify Customer without undue delay and in any event within 24 hours of becoming aware of a Security Incident, providing the known facts, affected services, data categories and remediation steps, with daily updates until closure.'
Questions for directors: Who determines when the supplier became aware? Does notification begin at suspicion or confirmation? Will the supplier support the customer's own regulator and customer communications? Who pays for notification, credit monitoring or forensic support?
2. Audit and evidence rights: assurance the board can use
An audit right that cannot be exercised in practice is a comfort blanket. Many suppliers offer certification or questionnaires instead of onsite access. That can be acceptable, but the board should know what evidence will arrive, how often and to what standard. The clause should require independent assurance reports, remediation plans and timely responses to security questionnaires.
Example language: 'Supplier shall provide annual independent assurance reports, summary penetration test results and completed security questionnaires within ten business days of request, and shall notify Customer of material control failures.'
Questions for directors: What evidence will we actually receive? Can it be shared with auditors and insurers? Does it cover the services we depend on, or only the supplier's headline environment? What happens if a material control fails and remediation is delayed?
3. Subcontractor controls: visibility, notice and flow-down
Cloud and outsourced models depend on subcontractors. The board needs visibility of material subcontractors, notice of changes, flow-down of security obligations and a right to object where risk increases. Concentration risk matters: a single downstream provider can support many services and many customers at once.
Example language: 'Supplier shall maintain a current list of material subcontractors, provide 30 days' prior written notice of changes, and impose equivalent security and breach notification obligations on those subcontractors.'
Questions for directors: Which subcontractors are material to our critical services? Where are they located? Can we object to a change, and what happens if we do? Who remains liable if a subcontractor fails?
4. AI and service-change notice: risk that arrives after signature
Services change. A new AI feature, a new data region or a change in security architecture can alter the risk profile long after the contract is signed. The clause should require notice of material changes and an opportunity to reassess before they take effect.
Example language: 'Supplier shall give 30 days' prior written notice of material changes to the service, including AI functionality, data location, security architecture or subcontractors, and shall not implement changes that materially increase risk without Customer approval.'
Questions for directors: What counts as a material change? Can we opt out of a new AI feature? Will our data be used to train models? How will the supplier test and document changes that affect our controls?
5. Data return on exit: the clause boards regret last
Exit is often read last and regretted first. The organisation needs its data back in a usable format, confirmation of deletion, transition assistance and clarity on backups. Derived data and AI training data need explicit treatment, not an assumption that deletion covers everything.
Example language: 'Upon termination, Supplier shall return all Customer Data in a machine-readable format within 30 days, provide transition assistance for 90 days, and certify deletion within 60 days, including backups and derived data, subject to legal retention requirements.'
Questions for directors: Can we get data in a format we can actually use? How long will transition take, and at what cost? What happens to backups? Will the supplier certify deletion, and what evidence will we receive?
How boards should use these clauses
First, ask for a clause-by-clause summary for the suppliers that support important business services. Second, map each clause to the risk it addresses and the evidence it produces. Third, involve legal, procurement, security and insurance advisers early enough to negotiate rather than merely accept. Fourth, record any exceptions and the risk owner who accepted them.
The contract is not a substitute for security controls. It is part of the control environment. A board that reads these five clauses before signature is better placed to answer the questions that follow an incident: what did we know, what could we require, and what can we prove?
