Organizations spend significant time evaluating vendors, reviewing security questionnaires, and validating compliance certifications. Yet many of the most important risk decisions are ultimately documented in contracts.
During a session at the Gartner Security & Risk Management Summit on third-party cyber risk, Gartner Senior Director Analyst Oscar Isaka highlighted how contract terms can influence an organization’s ability to manage security, protect data, and respond effectively when vendors experience disruptions or security incidents.
The conversation emphasized that cybersecurity professionals should not be expected to act as lawyers.
Instead, effective vendor risk management requires collaboration among security teams, procurement, legal counsel, business sponsors, and the vendor itself. When these stakeholders work together early in the procurement process, organizations are better positioned to define expectations and avoid surprises after services are already in production.
Why It Matters: Third-party incidents continue to be a significant contributor to cybersecurity risk. As organizations increasingly rely on cloud services, SaaS platforms, managed service providers, AI-enabled tools, and outsourced operations, a vendor’s security posture can directly affect business operations. While contracts cannot prevent breaches or outages, they can establish accountability and provide recourse when issues arise. Strong contract language helps organizations manage risk before problems occur rather than scrambling to address gaps after an incident.
- Start with organization-specific security requirements. Rather than relying on generic questionnaires or requesting every available security document, organizations should identify the controls that matter most for their environment. Requirements should reflect the nature of the service being purchased, the type of data involved, and the potential business impact if the vendor experiences a security failure. This approach creates a more focused and scalable review process.
- Define data ownership and acceptable use in clear terms. Contracts should explicitly state who owns the data, how it may be used, where it may be stored, and what happens to it at the end of the relationship. Isaka specifically highlighted growing concerns around AI, noting that organizations should understand whether vendors intend to use customer data for model training or other purposes beyond delivering contracted services. Retrieval rights, deletion procedures, and geographic restrictions should also be addressed.
- Validate security claims beyond questionnaires and certifications. Security assessments should not stop at a completed questionnaire or a SOC 2 report. Teams should review the scope, timing, and applicability of security attestations while also examining referenced privacy policies, security addenda, and supporting documentation. Organizations should maintain records of the versions reviewed because vendor policies and commitments can change over time.
- Address fourth-party dependencies and subcontractors. Vendors increasingly depend on cloud providers, AI platforms, subcontractors, and other external partners to deliver services. These fourth-party relationships can introduce risks that are difficult to see during a standard assessment. Contracts should identify critical subcontractors, define notification requirements for material changes, and ensure that failures by these external parties do not automatically excuse the vendor from meeting its obligations.
- Plan for service disruptions, acquisitions, and product retirements. One of the examples discussed involved a technology solution that was discontinued after an acquisition, forcing customers to find alternatives with little notice. Contracts should establish transition support, service continuity expectations, and notice periods for product retirement or end-of-support decisions. These provisions can provide valuable time for organizations to migrate systems and reduce operational disruption.
- Identify and document non-negotiable requirements. Every organization should define a small set of security requirements that represent true deal breakers. These may include incident notification timelines, data segregation requirements, regulatory obligations, insurance coverage, MFA, or geographic restrictions on data processing. By clearly communicating these expectations early, procurement and legal teams can negotiate from a stronger position and avoid accepting risks that fall outside organizational tolerance.
- Treat contract management as an ongoing process. Signing the agreement is not the finish line. Organizations must ensure that services are delivered according to contract terms, security commitments remain valid, and changes in vendor operations are properly reviewed. Continuous oversight helps ensure that the protections negotiated during procurement continue to provide value throughout the relationship.
Trusted insights for technology leaders
Our readers are CIOs, CTOs, and senior IT executives who rely on The National CIO Review for smart, curated takes on the trends shaping the enterprise, from GenAI to cybersecurity and beyond.
Subscribe to our 4x a week newsletter to keep up with the insights that matter.
