NIS2-compliant cybersecurity contracts: Protection and responsibility when working with third-party vendors

NIS2-Compliant Cybersecurity Contracts: Protection and Responsibility in Collaboration with Third-Party Providers

Contractual agreements for cybersecurity with third-party providers are essential to ensure that all involved parties meet the cybersecurity requirements according to applicable regulations, such as NIS2. Below are the key aspects that such agreements should include to ensure the security and resilience of IT infrastructure.

1. Cybersecurity Requirements

Compliance with Standards

Third-party providers are required to comply with all relevant national and international cybersecurity standards, including the NIS2 Directive and common norms like ISO/IEC 27001. Providers must regularly provide evidence of compliance with these standards, for example through certifications or independent audits.

Regular Risk Assessments

To identify potential threats and vulnerabilities early on, third-party providers conduct regular risk assessments. The results of these assessments are to be provided to the company in the form of a report, which also includes planned risk mitigation measures.

Adaptation to New Threats

Security measures are continuously reviewed and adapted to newly identified threats and vulnerabilities. Third-party providers promptly inform the company of any potential risks that could impact the collaboration.

2. Security Measures

Technical Security Measures

Providers must implement technical measures such as:

• Encryption: Use of strong encryption for sensitive data at rest and in transit.
• Access Controls: Strict implementation of access controls to ensure that only authorized personnel have access to systems and data.
• Intrusion Detection/Prevention Systems (IDS/IPS): Implementation of systems to detect and prevent intrusion attempts.

Organizational Security Measures

• Training: Regular cybersecurity training and NIS2 requirements for the third-party provider’s personnel.
• Security Policies: Development of comprehensive security policies governing the handling of data, networks, and systems.
• Incident Response Plan: A clear, documented, and regularly tested plan for handling security incidents.

Third-Party Management

If the third-party provider uses subcontractors, they must comply with the same cybersecurity standards. Regular audits of subcontractors are to be conducted, and compliance with security requirements must be documented.

3. Incident Response Times

Immediate Notification

In the event of a security incident, the third-party provider must immediately, but no later than within 24 hours, provide an initial assessment of the incident, affected systems and data, and immediate measures taken.

Incident Response

Within 48 hours of the incident being identified, a detailed Incident Response Report must be provided. This includes:

• Nature of the Incident: Description and affected areas.
• Actions Taken: Immediate containment measures.
• Corrective Measures: Long-term strategies to prevent similar incidents.
• Restoration: Steps to resume normal operations.

Communication

During an incident, regular status updates and close collaboration with the Incident Response Team are required. All measures and communication steps must be documented.

4. Responsibilities

Responsibility for Cybersecurity

Third-party providers are responsible for implementing and maintaining all agreed-upon security measures. A designated security officer serves as the primary contact person.

Liability for Security Incidents

The third-party provider is liable for all damages resulting from breaches of the agreed security standards. Adequate insurance to cover compensation claims is mandatory.

Audit Rights

The company reserves the right to conduct unannounced audits to verify compliance with cybersecurity requirements. The third-party provider must fully cooperate.

5. Final Provisions

Contractual Penalties and Sanctions

If the agreed cybersecurity measures are not adhered to, the contract includes penalties, including potential contract termination and financial sanctions.

Review and Adaptation

The security requirements are regularly reviewed and adjusted to new legal regulations, threat landscapes, or technological developments. Changes in security practices must be reported immediately.

Duration and Validity

These agreements apply for the entire contract term and beyond, for the period during which the third-party provider has access to the company’s data or systems. In the event of a contract extension, the security requirements will be re-evaluated and adjusted if necessary.
 
By including these elements in contracts, companies can ensure that third-party providers maintain a high level of cybersecurity and effectively protect their systems, data, and business operations.