October 2026. ISO 27001 (controls 5.19 to 5.22) and NIS2 both ask for controlled supplier relationships. A good supplier assessment starts with the contract: that is where you record what the supplier must do. These are the terms that matter in practice. See also our overview of supplier management.
1. Security level and certification
State the level you expect: for example a valid ISO 27001 certificate whose scope covers your service, or a SOC 2 report. Ask for an annual update and check the scope: a certificate for the office says nothing about the platform.
2. Incident notification
Agree a hard deadline within which the supplier informs you of an incident that touches your data. You have your own deadlines under NIS2 and the GDPR, so the supplier must be faster than yours. See notification duty in practice.
3. Subprocessors and data location
Require a current subprocessor list, notice of changes and the right to object. Record where data is stored and processed. For personal data a processor agreement belongs here; see the checklist and subprocessor due diligence.
4. Audit right and evidence
A full audit right is often unrealistic with large SaaS vendors. A workable alternative is the right to relevant audit reports, answers to an annual questionnaire and cooperation with a supervisory request.
5. Exit and termination
Describe how you get your data back, in what format, within what period, and how the supplier demonstrably deletes it. For financial entities this is mandatory under DORA; see exit planning. For everyone, an exit you never tested stays on paper.
Enforcing means checking
Put the terms in a register with the owner per supplier, the date of the last assessment and open actions. That register is exactly what the auditor asks for when reviewing the supplier chapter.
This article is general information and not legal advice. Have contract wording reviewed by a lawyer.