# Customer Security Addendum: [Provider name] and [Customer name] > Structure and clause library for a security addendum (also called an > information security schedule or security exhibit) attached to a > customer agreement for a hosted or managed service. It covers the > provider's security programme, maintenance of certifications, the > security measures annex, personnel, sub-processors and > subcontractors, data location, assessment and audit rights, security > incident notification, vulnerability testing, continuity, return and > deletion of data, customer responsibilities and a pointer to the > liability terms of the main agreement. It supports ISO/IEC 27001:2022 > + Amd 1:2024 Annex A controls A.5.20 (security terms in supplier > agreements, seen from the supplier side), A.5.31 (legal, regulatory > and contractual requirements), A.5.34 (privacy and PII protection) > and A.5.14 (information transfer), with guidance from ISO/IEC > 27002:2022 and ISO/IEC 27036-2:2022. Replace every `[bracketed]` > value and every row marked *Example*. This is a documentation format, > not legal advice. ## Document control | Field | Value | |---|---| | Document ID | DOC-ISMS-117 | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@legal-counsel] | | Approvers/reviewers | [@ciso], [@isms-manager], [@dpo], [@head-of-sales] | | Last updated | YYYY-MM-DD | | Classification | [Internal for the playbook; the clause text is shared with customers] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (A.5.14, A.5.20, A.5.31, A.5.34); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022 | | Next scheduled review | YYYY-MM-DD (12 months, or when law, certifications or the service architecture change) | | Main agreement reference | [Master services agreement or terms of service, version] | | Data processing agreement reference | [DPA version] | | Services covered | [Service names and plans] | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | Legal counsel | [@legal-counsel] | [Prepared] | YYYY-MM-DD | | ISMS manager | [@isms-manager] | [Reviewed: operability of every commitment] | YYYY-MM-DD | | Privacy | [@dpo] | [Reviewed] | YYYY-MM-DD | | Top management | [@ciso] | [Approved as standard position] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 0.1 | YYYY-MM-DD | [@author] | First draft | | 1.0 *(Example)* | 2027-04-01 | [@legal-counsel] | Standard addendum issued after certification | | 1.1 *(Example)* | 2027-11-15 | [@legal-counsel] | Clause 8 notification period aligned with incident response plan update | ## Contents - [1. Purpose and when to use](#1-purpose-and-when-to-use) - [2. Definitions](#2-definitions) - [3. Contract structure and order of precedence](#3-contract-structure-and-order-of-precedence) - [4. Security programme and certifications](#4-security-programme-and-certifications) - [5. Personnel and confidentiality](#5-personnel-and-confidentiality) - [6. Sub-processors and subcontractors](#6-sub-processors-and-subcontractors) - [7. Data location and transfers](#7-data-location-and-transfers) - [8. Security incident notification](#8-security-incident-notification) - [9. Assessments and audit rights](#9-assessments-and-audit-rights) - [10. Vulnerability management and testing](#10-vulnerability-management-and-testing) - [11. Business continuity](#11-business-continuity) - [12. Return and deletion of customer data](#12-return-and-deletion-of-customer-data) - [13. Customer responsibilities, liability and term](#13-customer-responsibilities-liability-and-term) - [14. Negotiation playbook and commitment register](#14-negotiation-playbook-and-commitment-register) - [15. Regulatory examples](#15-regulatory-examples) - [16. Size tiers](#16-size-tiers) - [17. Records and evidence](#17-records-and-evidence) - [18. References](#18-references) - [Annex 1. Security measures](#annex-1-security-measures) - [Annex 2. Contacts and notification details](#annex-2-contacts-and-notification-details) ## 1. Purpose and when to use This addendum sets out the information security commitments of [Provider name] ("Provider") to [Customer name] ("Customer") for the services described in the main agreement. It turns the Provider's ISMS into contractual terms that are clear, testable and consistent with what the Provider operates. Use it: - as a standard attachment to every customer agreement for the hosted service, or above a contract value or data sensitivity threshold set by management; - as the reference when a customer sends its own security schedule: compare each customer clause with the matching clause here and use the playbook in section 14; - as a checklist for operations: every clause has an owner and a record (section 17). The addendum does not replace the data processing agreement, which governs personal data processing duties under data protection law. When both apply, section 3 sets the order. ## 2. Definitions In this addendum, terms defined in the main agreement keep their meaning. In addition: | Term | Meaning in this addendum | |---|---| | Customer Data | Data that Customer or its users submit to the services, including personal data | | Security Incident | A confirmed breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data. Unsuccessful attempts that do not compromise Customer Data (such as blocked scans or failed log-ins) are not Security Incidents | | Security Measures | The technical and organisational measures in Annex 1 | | Sub-processor | A third party engaged by Provider that processes Customer Data | | Subcontractor | A third party engaged by Provider to deliver part of the services, whether or not it processes Customer Data | | Certification | A certificate or attestation report listed in clause 4.2 | | Business Day | A day other than a weekend or public holiday in [jurisdiction of the main agreement] | ## 3. Contract structure and order of precedence ```mermaid flowchart TD A["Main agreement (MSA or terms)"] --> B["Order form: services, plan, data location"] A --> C["Data processing agreement (personal data)"] A --> D["Customer security addendum (this document)"] A --> E["Service level agreement"] D --> F["Annex 1: Security measures"] D --> G["Annex 2: Contacts and notification details"] C --> H["Sub-processor list"] ``` Clause template (*Example*): > 3.1 This addendum forms part of the main agreement. If this addendum > conflicts with the main agreement on a matter of information > security, this addendum prevails. If it conflicts with the data > processing agreement on the processing of personal data, the data > processing agreement prevails, except that the shorter notification > period applies to Security Incidents. > > 3.2 Nothing in this addendum extends or limits the liability terms of > the main agreement unless clause 13.3 says so expressly. ## 4. Security programme and certifications Clause template (*Example*): > 4.1 Provider will maintain an information security management system > that meets the requirements of ISO/IEC 27001:2022 (or a later > edition) for the systems, people and processes that deliver the > services, and will implement and maintain the Security Measures. > > 4.2 Provider will maintain the following Certification for the scope > that covers the services: ISO/IEC 27001 certification issued by a > certification body accredited by an accreditation body that is a > signatory of the Global ACI MRA (formerly the IAF MLA), with a scope > that includes the services. Provider will make the current certificate > available on its trust centre and will provide the Statement of > Applicability on request under confidentiality. > > 4.3 If a Certification is suspended or withdrawn, or is not renewed by > its expiry, Provider will notify Customer within [10] Business Days, > explain the reason and the remediation plan, and give Customer the > assessment rights in clause 9.3 until the Certification is restored. > > 4.4 Provider may update the Security Measures, provided that the > update does not materially reduce the overall protection of Customer > Data. Provider will publish material changes on its trust centre. Notes: - Name only certifications actually held. A planned certification goes in a side letter or not at all, worded as a target (see `isms/certification-mark-usage`). - Avoid naming specific products or tools in the clause: commit to the outcome (for example "encryption at rest using industry-standard algorithms") and keep detail in Annex 1. ## 5. Personnel and confidentiality Clause template (*Example*): > 5.1 Provider will ensure that personnel with access to Customer Data > are bound by written confidentiality obligations, have been screened > to the extent allowed by applicable law, and receive security and > privacy training at onboarding and at least once a year. > > 5.2 Provider will grant access to Customer Data on a need-to-know and > least-privilege basis, review privileged access at least every > [three] months and remove access promptly when it is no longer > needed. ## 6. Sub-processors and subcontractors Clause template (*Example*): > 6.1 Provider will impose on each Sub-processor and each Subcontractor > with access to Customer Data written security obligations that > protect Customer Data at least as well as this addendum, and remains > responsible for their performance. > > 6.2 Provider will assess the security of each Sub-processor before > engagement and review it at least once a year. > > 6.3 Provider will maintain a list of Sub-processors and notify > Customer of any intended addition or replacement as set out in the > data processing agreement, including Customer's right to object. ## 7. Data location and transfers Clause template (*Example*): > 7.1 Provider will store Customer Data at rest in the hosting regions > stated in the order form, including backups and disaster recovery > copies. > > 7.2 Provider may access Customer Data from other locations only to > provide support, maintain security or comply with law, and only under > the transfer mechanisms set out in the data processing agreement. > > 7.3 Provider will notify Customer at least [90] days before changing > a hosting region stated in the order form. ## 8. Security incident notification Clause template (*Example*): > 8.1 Provider will notify Customer without undue delay, and in any > event within [48] hours, after Provider becomes aware of a Security > Incident. Notice is sent to the contacts in Annex 2. > > 8.2 The notice will describe, to the extent then known, the nature of > the Security Incident, the categories and approximate volume of > Customer Data affected, the likely consequences, the measures taken > or proposed, and a contact for further information. Provider will > provide updates as further information becomes available. > > 8.3 Provider will take reasonable steps to contain and remediate the > Security Incident, preserve relevant evidence, and give Customer the > information Customer reasonably needs to meet its own legal > notification duties. > > 8.4 Provider will provide a written summary of the root cause and > corrective actions within [20] Business Days after closing the > Security Incident. > > 8.5 Notification of a Security Incident is not an admission of fault > or liability by Provider. Operational alignment: the incident response plan (DOC-ISMS-020) must contain a step that checks every affected customer's contractual period in the commitment register (section 14) before the internal deadline. Many customers have their own short regulatory deadlines (for example under NIS2 or DORA, section 15), so they ask for short periods; agree to a period only if the incident process can meet it at night and at weekends. ```mermaid sequenceDiagram participant P as Provider incident team participant L as Provider legal and DPO participant C as Customer security contact P->>P: Detect event and triage P->>L: Escalate suspected Security Incident L->>P: Confirm Security Incident and affected customers P->>C: Initial notice within contractual period P->>C: Updates as facts are confirmed P->>C: Root cause summary after closure ``` ## 9. Assessments and audit rights Clause template (*Example*): > 9.1 Provider will make available on request, under confidentiality, > its current Certification, Statement of Applicability, the summary of > its most recent independent penetration test and a completed standard > security questionnaire. > > 9.2 Customer may send one security questionnaire per contract year, > and additional ones after a Security Incident affecting Customer > Data. Provider will answer within [30] days. > > 9.3 If the information in clauses 9.1 and 9.2 does not reasonably > show compliance with this addendum, or a regulator with authority > over Customer requires it, Customer or an independent auditor bound > by confidentiality may conduct an audit, no more than once per > contract year, on at least [30] days' written notice, during Business > Days, in a way that does not disrupt the services or compromise the > security or confidentiality of other customers' data. The audit is > remote unless an on-site visit is necessary for its purpose. > > 9.4 Each party bears its own audit costs unless the audit reveals a > material breach of this addendum by Provider. Provider will remedy > confirmed findings within a reasonable period agreed with Customer. Customer audits are managed like other external reviews: findings enter the audit findings register (DOC-ISMS-086) and evidence is shared at tier T3 under the answer library rules (DOC-ISMS-115 section 7). ## 10. Vulnerability management and testing Clause template (*Example*): > 10.1 Provider will maintain a vulnerability management process, > remediate vulnerabilities according to their severity, and have an > independent penetration test of the services performed at least once > a year. > > 10.2 Customer may perform its own security testing of its own tenant > only with Provider's prior written approval and under Provider's > testing rules. Testing of shared infrastructure or of other > customers' data is not allowed. ## 11. Business continuity Clause template (*Example*): > 11.1 Provider will maintain and test at least once a year business > continuity and disaster recovery plans for the services, and will > back up Customer Data in a way that allows recovery within the > targets stated in Annex 1. > > 11.2 Service availability commitments are set out in the service > level agreement. ## 12. Return and deletion of customer data Clause template (*Example*): > 12.1 During the term and for [30] days after it ends, Customer may > export Customer Data using the export features of the services. > > 12.2 After the export window, Provider will delete Customer Data from > production systems within [30] days, and backup copies will be > deleted as they expire, within a further [35] days, unless law > requires Provider to keep them. Retained data stays protected under > this addendum until deleted. > > 12.3 On request, Provider will confirm deletion in writing. ## 13. Customer responsibilities, liability and term Clause template (*Example*): > 13.1 Customer is responsible for the security of its own systems and > accounts, including managing its users and their access rights, > enabling the authentication features offered, keeping credentials > confidential, protecting data it exports and promptly reporting > suspected unauthorised use of its accounts. > > 13.2 Customer will not upload to the services data types excluded in > the order form (for example payment card data) unless agreed in > writing. > > 13.3 Liability arising from this addendum is subject to the > limitations and exclusions of the main agreement. [If a separate cap > for data protection or security breaches is agreed, state it in the > main agreement and refer to it here.] > > 13.4 This addendum applies for as long as Provider processes Customer > Data. Clauses 8, 12 and the confidentiality of audit information > survive termination until all Customer Data is deleted. ## 14. Negotiation playbook and commitment register ### 14.1 Positions per clause | Clause | Standard position | Acceptable fallback (needs ISMS manager approval) | Do not accept without top management approval | |---|---|---|---| | 4.2 Certifications | ISO/IEC 27001 certification held | Add a commitment to share the surveillance audit outcome summary yearly | Commitment to obtain a new certification by a date | | 7.1 Data location | Regions in order form | Named country instead of region | Named building or data centre, or a ban on all support access from other countries | | 8.1 Notification period | [48] hours after awareness of a confirmed Security Incident | [24] hours if the customer is subject to a short regulatory deadline and the incident process supports it | Notice of every event or suspected incident, or a period that starts at "detection" | | 9.3 Audit | Once a year, 30 days' notice, remote first | On-site once a year for regulated customers, at their cost | Unlimited audits, short notice, access to other customers' data or to T4 material | | 10.2 Customer testing | With prior approval | Annual window with agreed rules | Unannounced testing | | 12.2 Deletion | 30 days production, backups as they expire | Faster production deletion on request | Immediate deletion from backups | | 13.3 Liability | Main agreement caps apply | Separate higher cap for data breaches agreed in the main agreement | Uncapped liability for any security breach | ### 14.2 Commitment register (*Example*, Quillmere Analytics Ltd) | Commitment ID | Customer | Clause | Deviation from standard | Operational owner | Where it is enforced | |---|---|---|---|---|---| | COM-001 *(Example)* | [Customer A, financial services] | 8.1 | Notice within 24 hours | [@isms-manager] | Incident response plan contact list, on-call runbook | | COM-002 *(Example)* | [Customer A, financial services] | 9.3 | One on-site audit per year | [@isms-manager] | ISMS annual calendar (DOC-ISMS-032) | | COM-003 *(Example)* | [Customer B, public sector] | 7.1 | Data at rest in one named country | [@platform-lead] | Infrastructure as code policy check | | COM-004 *(Example)* | [Customer C] | 12.2 | Production deletion within 10 days | [@dpo] | Offboarding runbook | Quillmere Analytics Ltd (46 staff) has 4 deviations across 3 customers in this example; the 0.5 FTE ISMS manager reviews the register each quarter with legal counsel and before every surveillance audit. ## 15. Regulatory examples | Regime (example) | What customers may ask the provider to accept | Clauses affected | |---|---|---| | GDPR, Regulation (EU) 2016/679, Art. 28 and 33(2) | Processor terms in the DPA, including assistance with security and breach duties; processor to inform the controller without undue delay after becoming aware of a personal data breach | 6, 8, 9, 12 (with the DPA) | | NIS2, Directive (EU) 2022/2555, Art. 21 | Essential and important entities must address supply chain security, including security aspects of their relationships with direct suppliers, in their risk management measures, so they ask suppliers for contractual security terms; national transposition laws apply | 4, 8, 9 | | DORA, Regulation (EU) 2022/2554, Art. 30 | Financial entities must include key contractual provisions for ICT services (for example service descriptions, data locations, availability and security of data, assistance in ICT incidents, cooperation with authorities, termination rights), with more for services that support critical or important functions (for example audit and access rights, exit strategies) | 7, 8, 9, 12, plus exit terms | | US sector rules (for example health and financial privacy rules) | Sector-specific agreements such as business associate terms | Separate sector addendum | These rows are short summaries in our own words, given as examples to discuss with counsel. They are not legal advice and not a complete statement of any law: read the official texts (EUR-Lex for EU law), the national transposition laws for NIS2, and any delegated or implementing acts before you rely on them. DORA Art. 30, for example, has a general list of key provisions for all ICT service contracts (Art. 30(2)) and additional provisions for ICT services that support critical or important functions (Art. 30(3)). Keep the regimes that apply to your customers in the legal, regulatory and contractual register (DOC-ISMS-014). ## 16. Size tiers | Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large or multi-site: Quillmere Group (2,400 staff, 6 sites) | |---|---|---|---| | Typical use | Standard addendum on every contract; few deviations | Hospital customers bring their own schedules; health privacy terms common | Many customer frameworks per business unit; OT customers ask for site and plant security terms | | Approver of deviations | ISMS manager (0.5 FTE) and external counsel | Legal team with ISMS manager and DPO | Contract governance board with CISO office and regional legal | | Audit capacity | One customer on-site audit per year at most | Several remote audits per year, scheduled in the annual calendar | Dedicated customer assurance team; audits coordinated with ISO 9001 and ISO 22301 audits | | Commitment register | Spreadsheet, under 10 entries | Contract management tool with alerts | Group register with site and entity fields | | Main risk | Agreeing to terms that one person cannot operate | Hospital notification periods that differ from the DPA | A site signs terms that conflict with group policy | ## 17. Records and evidence | Record | Supports | Kept by | Where | Retention (*Example*) | |---|---|---|---|---| | Approved standard addendum with version history | 7.5, A.5.31 | Legal counsel | [Contract repository] | Life of document plus 6 years | | Signed addenda and negotiated variants | A.5.20, A.5.31 | Legal counsel | [Contract repository] | Contract term plus 6 years | | Commitment register and quarterly reviews | A.5.31, 9.1 | ISMS manager | [Contract tool] | Contract term plus 6 years | | Security Incident notices and root cause summaries sent | A.5.26, A.5.24 | ISMS manager | Incident register (DOC-ISMS-021) | 6 years | | Customer audit plans, reports and findings | A.5.35, 9.2 | ISMS manager | DOC-ISMS-086 | 6 years | | Deletion confirmations | A.8.10 | DPO | [Document store] | 6 years | | Certificate status notifications (clause 4.3) | A.5.31 | ISMS manager | [Document store] | 6 years | ## 18. References | Reference | Edition and status (checked 2026-11-01) | Use | |---|---|---| | ISO/IEC 27001:2022 + Amd 1:2024 | Current; https://www.iso.org/standard/82875.html, Amd 1 https://www.iso.org/standard/88435.html | A.5.14, A.5.20, A.5.31, A.5.34 | | ISO/IEC 27002:2022 | Current; https://www.iso.org/standard/75652.html | Control guidance | | ISO/IEC 27036-2:2022 | Current; supplier relationship requirements (catalogue id 82060) | Clause topics for supplier agreements | | ISO/IEC 27701:2025 | Current; https://www.iso.org/standard/85819.html | Privacy terms where a PIMS is in place | | GDPR, Regulation (EU) 2016/679 | In force; https://eur-lex.europa.eu/eli/reg/2016/679/oj | Example: processor terms and breach notification | | NIS2, Directive (EU) 2022/2555 | In force, national transposition; https://eur-lex.europa.eu/eli/dir/2022/2555/oj | Example: supply chain security | | DORA, Regulation (EU) 2022/2554 | Applies from 17 January 2025; https://eur-lex.europa.eu/eli/reg/2022/2554/oj | Example: key contractual provisions | Related templates: `legal-lite/master-services-agreement-outline`, `legal-lite/dpa`, `legal-lite/sla-outline`, `legal-lite/subprocessor-list`, `isms/supplier-security-agreement-27036`, `isms/security-questionnaire-answer-library`, `isms/security-whitepaper-trust-center`, `compliance/incident-response-plan`, `compliance/statement-of-applicability`, `compliance/legal-register`, `isms/certification-mark-usage`, `isms/control-evidence-matrix`. ## Annex 1. Security measures | Measure ID | Area | Measure | Annex A controls | |---|---|---|---| | SM-01 *(Example)* | Governance | ISMS certified to ISO/IEC 27001:2022; policies approved by management and reviewed yearly | A.5.1, A.5.2 | | SM-02 *(Example)* | Access control | Role-based access, MFA for all staff access to production, quarterly privileged access review | A.5.15, A.5.18, A.8.2, A.8.5 | | SM-03 *(Example)* | Cryptography | Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) with managed keys | A.8.24 | | SM-04 *(Example)* | Secure development | Peer review, automated dependency and secret scanning, annual penetration test | A.8.25, A.8.28, A.8.29 | | SM-05 *(Example)* | Operations | Managed endpoints with EDR, vulnerability remediation targets of 7 days critical and 30 days high | A.8.1, A.8.7, A.8.8 | | SM-06 *(Example)* | Logging and monitoring | Centralised security logs kept 12 months, daily review, out-of-hours alerting for critical events | A.8.15, A.8.16 | | SM-07 *(Example)* | Resilience | Daily backups to a second region, quarterly restore tests, recovery time 8 hours and recovery point 24 hours | A.8.13, A.8.14, A.5.30 | | SM-08 *(Example)* | Suppliers | Sub-processors assessed before engagement and yearly, security terms flowed down | A.5.19, A.5.20, A.5.22 | | SM-09 *(Example)* | Incident management | Documented incident response plan tested yearly | A.5.24, A.5.26 | | SM-10 *(Example)* | Deletion | Customer Data deleted per clause 12, backups expire within 35 days | A.8.10 | ## Annex 2. Contacts and notification details | Purpose | Provider contact | Customer contact | |---|---|---| | Security Incident notices (clause 8) | [Provider security role mailbox], [24x7 phone] | [Customer security role mailbox] | | Audit and questionnaire requests (clause 9) | [Provider trust or compliance mailbox] | [Customer vendor risk mailbox] | | Certification status notices (clause 4.3) | [Provider ISMS mailbox] | [Customer contract owner] | | Data deletion confirmation (clause 12) | [Provider privacy mailbox] | [Customer data protection contact] | ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.14, A.5.20, A.5.31 and A.5.34, with ISO/IEC 27002:2022 and ISO/IEC 27036-2:2022 as guidance. The clause wording, positions and examples are original. Control numbers are cited with short descriptive labels; no ISO/IEC text is reproduced, and you need the official standards to implement the controls. Laws are summarised in our own words as international examples. This is a documentation format, not legal advice: have qualified counsel review every clause for your jurisdiction and contract. Check the current editions and legal texts before use. Template licence: MIT.