Contractual Security Obligations

The contractual dimension of the Security Consulting function’s compliance advisory addresses the security obligations that the organisation’s commercial relationships create through the agreements it enters into with its customers, its partners, its suppliers, and the financial and technology service providers whose engagement the business model requires. Contractual security obligations differ from the regulatory compliance requirements that the preceding section addresses in their origin, their specificity, and their enforcement mechanism, but they share the fundamental governance characteristic that their fulfilment is not optional and their breach creates the financial, legal, and reputational consequences that the organisation’s governance must prevent through the security architecture and the contractual compliance monitoring that the obligation’s terms demand.

The Security Consulting function’s engagement with contractual security obligations must be governed from the perspective that the organisation simultaneously occupies in its commercial relationships: as the customer whose contracts with suppliers and vendors impose the security obligations that the supply chain risk management must enforce, and as the service provider whose contracts with customers and partners impose the security obligations that the security architecture must maintain to preserve the commercial relationship and the revenue that it generates. Both perspectives create the contractual security advisory requirements that the Security Consulting function must address with the same rigour, recognising that the security failure in either direction, whether the organisation’s failure to meet its obligations to its customers or its suppliers’ failure to meet their obligations to the organisation, creates the consequences that the commercial relationship’s continuation and the organisation’s own security posture depend upon preventing.

The Contractual Security Landscape #

The contractual security obligations that the organisation’s commercial relationships create span a range of specificity and rigour that the Security Consulting function must understand with sufficient depth to advise on the security architecture required to meet each obligation category effectively.