A security annex is the part of a supplier contract that turns your customer’s security requirements into obligations, each with a clock, an audit right and a consequence. Its core is usually the eight supplier contract points in Implementing Regulation (EU) 2024/2690, plus data location, liability and termination. The questionnaire is a filter. The annex is the contract.
This guide covers what a security annex is, where its clauses come from, the ten clauses, which ones to negotiate, how to respond, and what to build once.
| Clause | What it asks for | Where it comes from |
|---|---|---|
| 1. Security requirements | A named standard “or equivalent” | Reg. 2024/2690, point 5.1.4(a) |
| 2. Personnel | Training, background checks, named access | Point 5.1.4(b), (c) |
| 3. Incident notification | Notice within a fixed time | Point 5.1.4(d); GDPR Art. 33(2) |
| 4. Audit rights | Audit on notice, or audit reports | Point 5.1.4(e); GDPR Art. 28(3)(h) |
| 5. Vulnerability handling | Accept reports, fix by severity | Point 5.1.4(f) |
| 6. Subcontracting | Disclose, get consent, flow terms down | Point 5.1.4(g); GDPR Art. 28(2) |
| 7. Return and destruction | Return or destroy data, and certify it | Point 5.1.4(h); GDPR Art. 28(3)(g) |
| 8. Data location | Where data sits and who reaches it | Customer’s terms |
| 9. Liability and insurance | Separate cap or indemnity for breaches | Customer’s terms |
| 10. Termination on incident | Exit on a material incident | Customer’s terms |
What is a security annex in a contract?
A security annex, or security schedule, sets out the information security obligations a supplier accepts when it signs. Where personal data is processed, it sits beside a data processing agreement.
It gets confused with the security questionnaire constantly. The questionnaire asks whether you have a control. The annex tells you what happens when you do not, and attaches a clock, an audit right and a termination trigger to each obligation. Suppliers spend weeks on the questionnaire and sign the annex assuming it says the same things. It does not. The first document is covered in how to answer a security questionnaire.
Where do security requirements in supplier contracts come from?
Your customer is passing its own obligations down to you.
NIS2. Article 21(2)(d) makes supply chain security a minimum measure, including “security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Article 21(3) requires the customer to take into account each direct supplier’s specific vulnerabilities and the quality of its products and cybersecurity practices, including secure development. Recital 85 encourages entities to put cybersecurity measures into contracts with direct suppliers. The customer’s side is in NIS2 supply chain security.
Implementing Regulation (EU) 2024/2690. It covers DNS, TLD, cloud, data centre, content delivery, managed and managed security service providers, online marketplaces, search engines, social networks and trust service providers. Point 5.1.4 of its annex requires their supplier contracts to specify, “where appropriate”, the eight points in the table. Point 5.2 requires a register of direct suppliers. Other entities are not bound by the list. It is still a concrete official reading of Article 21(2)(d), so expect it whoever your customer is.
ISO/IEC 27001:2022. Annex A has five supplier controls: 5.19 Information security in supplier relationships, 5.20 Addressing information security within supplier agreements, 5.21 Managing information security in the information and communication technology (ICT) supply chain, 5.22 Monitoring, review and change management of supplier services, and 5.23 Information security for use of cloud services. For a certified customer, your annex is usually how it shows its auditor that 5.20 operates.
In space, the Commission’s proposed EU Space Act of June 2025 would add supply chain security requirements for operators. It is still a proposal: as of September 2026 neither the Parliament nor the Council has adopted a position. Customers often draft for the regime they expect: see space suppliers and the four regimes.
What does each clause of a security annex ask for?
The first seven clauses map to point 5.1.4. The last three are commercial. Timeframes below are what annexes commonly contain in practice, not legal requirements.
1. Security requirements: a named standard, “or equivalent”
The clause names ISO 27001, a sector standard or NIST, and adds “or equivalent”. That word is where suppliers relax and should not. Equivalent means the customer decides, later, usually during an audit, whether what you have is equivalent.
What it costs: nothing to sign, considerable to satisfy without a certificate. A certificate ends the conversation if its scope covers the service you supply. Without one, it becomes a demonstration, every time. Either way, it does not answer the clauses on notification times, named access, subcontractors or data return. How far a certificate reaches is in ISO 27001 vs NIS2.
2. Personnel: training, background checks and named access
Point 5.1.4 covers staff awareness, skills, training and background verification. Annexes add a named list of people with access rather than a headcount, and sometimes nationality conditions.
What it costs: an access list that is true. In practice this is the clause most often failed, and the failure is structural rather than negligent: access is granted precisely and revoked from memory. How operators test the list is in ground segment access.
3. Incident notification within a fixed period
The regulation says “without undue delay”. Annexes turn that into hours: 24 from awareness is common, sometimes 12, occasionally 4. The customer has its own clock: an in-scope entity must send an early warning within 24 hours of becoming aware of a significant incident (NIS2 Article 23). For personal data, GDPR Article 33(2) requires a processor to notify the controller of a breach without undue delay.
Two traps. The clock starts on awareness, and awareness depends on detection you may not have. And many annexes cover incidents in your own estate even when the customer’s systems are untouched.
What it costs: a reachable named contact, a written trigger for what counts, and logs kept long enough to answer the follow-up questions. A twelve-hour clock is meaningless if the logs roll off in seven days.
4. Audit and inspection rights
An audit on notice, sometimes by a third party, on site or at your subcontractors. Point 5.1.4(e) allows audit reports instead. GDPR Article 28(3)(h) requires a processor to allow for and contribute to audits, including inspections. In practice, customers that use the right tend to do so after an incident elsewhere in their supply chain, with short notice.
What it costs: evidence within the notice period. If the notice is ten business days and your evidence takes three weeks to assemble, you are in breach of a clause you thought you had satisfied.
5. Vulnerability handling and patching
A route to report vulnerabilities to you, a duty to handle them, and often fix windows by severity: critical in seven days and high in thirty are common. The window runs from disclosure, not from when you noticed. If you do not track what you run, you cannot know whether the clock is running.
What it costs: a published contact, a triage owner, and a dependency inventory for anything you ship.
6. Subcontracting and flow-down
Disclose subcontractors in advance, impose equivalent terms, and often get written consent before adding one. For personal data, GDPR Article 28(2) already bars a processor from engaging another without the controller’s prior specific or general written authorisation.
Read the definition. “Subcontractor” is often drafted to include cloud and SaaS providers. A supplier that has not listed its hosting provider, CI service and ticketing tool is non-compliant on signature.
What it costs: a maintained supplier register with security terms and review dates, which you needed anyway.
7. Return and destruction at termination
Return or destroy customer data within a stated period and certify it in writing. Point 5.1.4(h) names retrieval and disposal of the information the supplier obtained. GDPR Article 28(3)(g) sets a similar duty for personal data, at the controller’s choice.
The certificate is the problem. It means knowing every copy: production, backups, the analytics warehouse, the engineer’s laptop, the support ticket with an attachment. Most suppliers sign this clause and could not honour it today.
What it costs: a data map. A sensible drafting point is that backups expire on their normal rotation, with the period named.
8. Data location, sovereignty and export control
Where data may be stored, which jurisdictions are excluded, who may access it from where. What it costs: knowing where each tool stores data, including the backup and log copies that are easy to forget.
9. Liability, indemnity and insurance
A carve-out from the liability cap for security breaches, an indemnity for regulatory fines and third-party claims, and cyber insurance at a stated limit. What it costs: real money. Your lawyer and your insurer should read it before you sign.
10. Termination on a material security incident
The right to terminate, sometimes immediately, on a material incident. What it costs: nothing until it happens, and everything when it does. “Material” is rarely defined, and defining it is worth more than shaving a day off the notification clock.
Which security annex clauses can you negotiate?
In practice, customers expect resistance on some clauses and not others. Push on the wrong ones and you look unprepared.
- Liability and indemnity. An uncapped indemnity for regulatory fines is common first-draft language, often negotiated down to a cap linked to contract value.
- Definitions. A threshold for “incident” and “material incident” is usually accepted, and it turns an open obligation into a bounded one.
- Audit mechanics. Ten business days’ notice rather than five, once a year rather than on demand, remote for routine checks. Audit reports in place of an audit, which point 5.1.4(e) itself allows.
Harder to move: the notification duty, flow-down and the security requirements, because the customer has to show them to its own authority or auditor. Negotiate the detail (the clock, the definition, the list), not the obligation.
How do you respond to a security annex?
- Read the definitions first: incident, material incident, subcontractor, customer data.
- Mark each obligation: meet today with evidence, meet by a date, or redline.
- Test every clock against your real detection time and log retention.
- Redline with an alternative, not a deletion.
- After signature, give each obligation an owner, so it is operated rather than filed.
SECURITY ANNEX RESPONSE CHECKLIST
Customer: ______________ Annex version: ______ Owner: ______________
Status per line: MEET NOW / MEET BY (date) / REDLINE
DEFINITIONS
[ ] "Incident": suspected or confirmed? Our estate or only theirs?
[ ] "Material incident" defined? If not, propose a threshold
[ ] "Subcontractor" includes cloud and SaaS? List attached?
CLAUSES
[ ] 1 Standard: ________ Certificate scope covers this service?
[ ] 2 Screening level: ______ Access list generated from systems?
[ ] 3 Notify within ___ hours. Log retention ___ days. Contact named?
[ ] 4 Audit notice ___ days. Evidence ready in time? Reports accepted?
[ ] 5 Fix windows: critical ___ days, high ___ days. Inventory current?
[ ] 6 Consent needed to add a subcontractor? Flow-down terms in place?
[ ] 7 Return or destroy within ___ days. Backup rotation ___ days
[ ] 8 Allowed locations: ________ Tools, backups and logs checked?
[ ] 9 Liability cap for breaches: ______ Insurance limit: ______
[ ] 10 Termination trigger defined? Suspension right? Cure period?
[ ] After signature: each obligation has an owner and a review dateThe technical reality: the annex asks about state, your records describe intent
Every clause is written in the present tense about a live condition. Who has access right now. What is running right now. Which suppliers touch customer data right now.
What a supplier brings is documents describing what was decided. The access list was true when written. The supplier register was accurate at the last review. Each is a photograph of an intent. That gap is one reason supplier access keeps appearing in incident reports while questionnaires come back clean. The questionnaire asks whether you have a leaver process and you truthfully answer yes. Nobody asks whether it ran last month.
Neither point 5.1.4 nor Annex A says how to keep the answers true between reviews. In practice it means generating the access list from identity systems, reconciling it against HR and contract end dates, raising orphaned accounts as findings, and letting the work produce the evidence. The CloudSoul platform works that way: automated collection from your systems, with a person reviewing the exceptions. To measure the gap before a customer does, start with a security audit. The wider programme is on the NIS2 page, and the sector view on the space page.
Security annex checklist: what to build once
Annexes ask overlapping questions in different words. Build the core once and the next annex is a mapping exercise, not a project.
- An access list generated from identity systems, reconciled against HR and contracts.
- A supplier register, including cloud and SaaS, with security terms and review dates.
- Log retention that survives an investigation, not one that satisfies a default.
- A dependency inventory for what you ship, and a vulnerability contact with an owner.
- A data map covering production, backups, logs, tickets and laptops.
- A named incident contact and a written trigger for what counts as an incident.
- An answer to “or equivalent”: a certificate with the right scope, or controls with evidence.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 21(2)(d), 21(3) and 23, and recital 85, EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690, Annex, points 5.1.4 and 5.2, EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), Articles 28 and 33, EUR-Lex.
- ISO/IEC 27001:2022, Annex A controls 5.19 to 5.23, ISO.
- European Commission, Proposal for a Regulation on the safety, resilience and sustainability of space activities in the Union (EU Space Act), COM(2025) 335, EUR-Lex; European Parliament, Legislative Observatory, procedure 2025/0335(COD); Council of the EU, progress report 8861/26 of 8 May 2026, Council register.
Frequently asked questions
What is a security annex in a contract?
A security annex, or security schedule, is the part of a supplier contract that sets out the information security obligations the supplier accepts. Unlike a security questionnaire it is binding, and each obligation usually comes with a deadline, an audit right and a consequence for breach.
What information security requirements should a supplier contract include?
Implementing Regulation (EU) 2024/2690 lists eight points, where appropriate: security requirements, staff awareness, skills and training, background verification, incident notification without undue delay, audit rights or audit reports, vulnerability handling, subcontracting rules, and obligations at termination such as retrieval and disposal of information.
Does NIS2 require security clauses in supplier contracts?
Article 21(2)(d) makes supply chain security a minimum measure, and recital 85 encourages entities to put cybersecurity measures into contracts with direct suppliers. The list of contract points in Implementing Regulation (EU) 2024/2690 binds only the digital providers that regulation covers, and each point applies where appropriate.
Which clauses in a security annex can a supplier negotiate?
In practice, liability and indemnity, the definitions of incident and material incident, and audit notice periods and frequency are the clauses customers expect to discuss. The notification duty, subcontractor flow-down and the security requirements are harder to move, so negotiate their detail rather than the obligation.
Does ISO 27001 certification satisfy a security annex?
It answers a clause that names ISO 27001, provided the certificate's scope covers the service you supply. It does not answer the clauses on notification times, named access, subcontractors or data return, which are about the contract rather than the management system.
