Does your organization include security requirements in agreements with vendors and partners based on the criticality of the data or systems involved?

Including security requirements in agreements helps ensure that third parties handling your data or accessing your systems maintain appropriate security controls. The level of security requirements should be proportional to the criticality of the data/systems and the potential impact if compromised. For example, a vendor processing sensitive customer data would have stricter requirements than one providing office supplies.

Evidence could include a vendor security assessment framework, contract templates with security clauses that vary by risk level, or a documented process for determining which security requirements to include in different types of agreements based on risk classification.