8 Cybersecurity Contract Clauses for Small Contractors

One of the most common challenges we see for clients of our Virtual CISO service is how to manage the risk of using freelancers and small contracting firms.

The use of freelancers and contractors is very common, especially in areas with specialized skills. We commonly see them in the form of CRM experts, financial experts, I.T. experts, and even cybersecurity experts!

Contractors Can Be Frustrating (from a Cybersecurity Perspective)

These relationships can be frustrating for our vCISO service clients. These small firms are often too small to be put through a formal “third party vendor risk” survey process. Honestly, they’d probably fail if we tried.

On the other hand, these smaller contracting firms are often too independent and maintain their own systems and processes. This makes it difficult to ensure they're doing all the right things to protect your data and your business.

We think a strong tool in this discussion is the contract you have in place with your freelancers and contractors. By adding cybersecurity contract clauses, this gives you the opportunity to set clear expectations without being too prescriptive.

Why Add Cybersecurity Contract Clauses?

Three reasons, really:

1. They clearly communicate your expectations for what security measures your freelancers will have in place.
2. They set the stage for clear communication on both sides of the relationship.
3. They help you to ensure that your business information is being properly handled.

Let’s cover some key clauses that we think you may want to add.

Essential Cybersecurity Contract Clauses

(1) Data Protection and Confidentiality

This clause should clearly state what information is considered confidential, where it is stored, and how the contractor should handle it. For example:

"Contractor agrees that all data housed in Salesforce.com is confidential and will not share, sell, or use this data for any purpose other than fulfilling the contract."

(2) Minimum Security Standards

Spell out the basic security measures you expect. Consider including specific requirements like:

• Up-to-date antivirus software, preferably Endpoint Detection & Response (EDR)
• Firewalls (either software or hardware)
• Encryption enabled on any computers they use
• Encryption for any services or sites they use for transferring data
• Go through your own Information Security policy and you might see a few other ideas.

(3) Password and Access Management

Strong, unique passwords and MFA are a must! Consider a clause like:

"Contractor will use strong, unique passwords for all accounts related to client work and will enable multi-factor authentication (MFA) for all accounts used for client work."

(4) Incident Reporting

If something goes wrong, you need to know fast. Try a clause like this:

"Contractor will report any suspected or confirmed data breaches to the client within 48 hours of discovery."

(5) Right to Audit

It's good to trust, but even better to verify. Include a clause that lets you check up on your contractor's security practices, like this:

"Client reserves the right to conduct security audits or request security attestations from the contractor with reasonable notice."

Even if you decide not to to exercise this right, having it in the contract ensures that you have the option to verify compliance if needed.

(6) Data Handling and Storage

Be clear about where and how your data should be stored:

"Contractor will only store client data on approved, secure devices and will not use public cloud storage without prior written approval."

(7) Training and Awareness

Help your contractors help you by requiring some basic training:

"Contractor agrees to complete annual cybersecurity awareness training provided or approved by the client."

(8) Background Checks

We recommend having any new contractors or employees pass a criminal background check:

"Contractor agrees to complete a criminal background check before members of their team are granted access to client data."

Making It Work: Implementing Your Clauses

Having great cybersecurity contract clauses is just the start. Here's how to make them really work:

• Be clear and specific: Avoid jargon and spell out exactly what you mean.
• Keep it reasonable: Remember, your contractors are often small businesses. Don't ask for enterprise-level security if it's not needed.
• Offer help: Consider providing resources or tools to help contractors meet your requirements.
• Stay up to date: Cyber threats evolve, and so should your clauses. Review and update them regularly.
• Foster a security-minded culture: Encourage open communication about security concerns.
• Offer help: You might consider providing resources or tools to help contractors meet your requirements.

Challenges You Might Face

Implementing these clauses isn't always smooth sailing. Here are some bumps you might hit:

• Pushback from contractors: Some might see these clauses as too demanding.
• Monitoring compliance: It can be tricky to check if contractors are following through.
• Keeping up with tech changes: New threats and solutions pop up all the time.

The key is to stay flexible and keep the lines of communication open.

We Are Not Lawyers

Nothing in this article is meant to be legal advice.

A lawyer, especially one experienced with privacy and information security matters, will likely have lots of other suggestions on what to add. Confidentiality and indemnification are two areas that come to mind, and that might have some relevance to what cybersecurity contract clauses end up in your final contract.

Also, it’s important to work with your attorney to determine which cybersecurity and privacy regulations might “flow down” to your contractors. If you work in areas like HIPAA, CMMC, and PCI, there are very specific rules you’ll need to follow.

In Conclusion

To keep your company safe, your cybersecurity program needs to work whether you’re working with large vendors or small vendors. By using smart cybersecurity contract clauses, you can “right-size” your approach to working with vendors who are too small to go through a formal third party vendor risk review.

With these tips and clauses in hand (and after a proper review from your attorney), you're well on your way to a more secure business relationship with your contractors.

If you’d like help with any aspect of your cybersecurity program, consider meeting with us to discuss our Virtual CISO service.