GUIDE · 08 / 8

Security schedule

Access · encryption · logging · vulnerabilities · continuity · incidents

WHAT IT IS

The schedule that concretely describes the security measures you apply to protect your customers' data.

WHEN IT COMES INTO PLAY

Required by large customers' procurement and security teams, often attached to the DPA.

WHY IT MATTERS

The security schedule describes concretely how you protect your customers' data. Large companies' procurement and security teams increasingly demand it, and read it line by line. Too vague, it blocks the sale; too ambitious, it commits you to practices your team doesn't follow. The right balance: faithfully describe what you do, in language the buyer recognizes.

WHAT IT OFTEN CONTAINS

Security program

The security program: responsibilities, internal policies and periodic review.

Access control

Access control: multi-factor authentication, least privilege, access reviews.

Encryption

Encryption of data in transit and at rest, and key management.

Logging and monitoring

Logging, monitoring and detection of suspicious activity.

Vulnerability management

Vulnerability management, penetration testing and patching.

Continuity and incident response

Business continuity, backups and incident response.

WHAT OFTEN GETS NEGOTIATED

Required certifications

WHAT THE BUYER OFTEN ASKS FOR

Specific certifications (SOC 2, ISO 27001) as a condition of the contract.

SUPPLIER SIDE

Describe the controls actually in place, and a realistic timeline if certification is underway.

The customer's policies or yours

WHAT THE BUYER OFTEN ASKS FOR

The right to impose their own security policies.

SUPPLIER SIDE

Your schedule as the reference, with a commitment to maintain an equivalent level of protection.

Penetration tests

WHAT THE BUYER OFTEN ASKS FOR

Penetration tests run by them, on your production.

SUPPLIER SIDE

Sharing a summary of tests run by an independent third party.

Remediation timelines

WHAT THE BUYER OFTEN ASKS FOR

The obligation to fix any vulnerability within a very short deadline.

SUPPLIER SIDE

Remediation timelines by severity, in line with industry practice.

SAMPLE CLAUSE

ENCRYPTION

« The Supplier encrypts Customer Data in transit using TLS 1.2 or later, and at rest using an industry-recognized algorithm such as AES-256. »

IN PLAIN TERMSData is unreadable to anyone who intercepts it or reaches the servers without authorization.

BEFORE YOU SIGN

Does the schedule describe what you actually do?

Is it consistent with your DPA?

Are remediation timelines realistic?

Are the certifications mentioned current?

Has your technical team reviewed it?

FREE

Personalized negotiation playbook

Share a link to your own contract: we turn it into a starter playbook with opening and fallback positions on the key points. Delivered by email.

Need us to negotiate it for you?