Which standards require a vendor contract security requirements?

ISO/IEC 27001:2022: 5.20; DORA (Regulation (EU) 2022/2554): Art. 30; The NIS2 Directive: Art. 21(2)(d).

What must a vendor contract security requirements contain under ISO 27001?

5.20: Establish and agree the relevant security requirements in each supplier contract. The ISO 27002 guidance beside 5.20: Requires the relevant information security requirements to be established and agreed with each supplier, scaled to the type of supplier relationship involved.

Who should own the vendor contract security requirements?

The clauses imply procurement or the vendor manager, with the information security lead. The register names the role so the line on your list can carry a name.

How often should a vendor contract security requirements be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a vendor contract security requirements?

Yes: https://compliance.theartofservice.com/policy-templates/vendor-contract-security-requirements

Every policy type · Suppliers and third parties

Vendor contract security requirements

The standard security terms written into every supplier agreement: access, incident notice, audit rights, sub-contracting, exit.

How the register reads it

Also called	security schedule, security addendum
Family	Suppliers and third parties
Document type	Standard. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the supplier and third-party security policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	Procurement or the vendor manager, with the information security lead.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, supplier and third-party security policy, is).
Template	Vendor contract security requirements.

Which standards require it, and what each expects it to contain

3 requiring clauses, 3 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.20 Addressing information security within supplier agreements

Establish and agree the relevant security requirements in each supplier contract.

What the ISO 27002 guidance expects the document to say: Requires the relevant information security requirements to be established and agreed with each supplier, scaled to the type of supplier relationship involved.

Evidence an auditor accepts: Executed agreements containing the agreed information security requirements, sampled across supplier tiers; the clause set used, covering confidentiality, information handling, incident notification with a timeframe, subcontracting, personnel screening, return or deletion at exit and right to audit; evidence requirements were scaled to the relationship type rather than applied as one template regardless
Common gap: missing explicit security clauses
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 30 Key contractual provisions

Contractual arrangements for the use of ICT services shall include the mandatory key contractual provisions (e.g. clear service descriptions, locations of data processing, data protection, accessibility/availability/integrity/security, assistance on incidents, audit and access rights, termination rights and exit strategies), with enhanced provisions for services supporting critical or important functions.

Evidence an auditor accepts: ICT contracts containing the mandatory key provisions (audit/access, termination, exit, security); enhanced provisions for critical/important-function services
Common gap: Contracts missing audit/access, termination or exit provisions
Source: DORA (Regulation (EU) 2022/2554)

The NIS2 Directive

NIS2 Art. 21(2)(d) Supply chain security, covering the relationship with each direct supplier and service provider

The Directive scopes this deliberately at direct suppliers and service providers, which makes the first artefact an inventory of who those parties are and which of them touch the network and information systems behind the service. From there the entity has to manage the security-related aspects of each relationship: what the supplier may access, what security obligations bind it, what happens on incident, and what happens at exit. Contract terms are the enforcement mechanism, so contracts that predate NIS2 and carry no security clauses are a live gap rather than a legacy inconvenience. Managed service providers and managed security service providers deserve separate attention because they hold privileged access into the estate, which makes their compromise the entity's incident.

Evidence an auditor accepts: Inventory of direct suppliers and service providers, flagged for access to in-scope systems; risk assessment per supplier proportionate to the access and criticality involved; contractual security clauses, including incident notification obligations and audit or assurance rights
Common gap: Inventory built from the procurement system, so shadow and free-tier services are missing
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Supply chain security policy · Vendor security assessment procedure