The security exhibit should describe a working process.
Ask what evidence supports the promises in the contract.
The question to ask
Read access controls, data minimization, retention, encryption, incident handling, and vendor oversight. Identify incorporated policies by version and distinguish promises from certifications or marketing descriptions.
Illustrative clause — not a court case
Hypothetical wording: Vendor uses industry-standard security. This gives little detail about systems, data, verification, or responsibility when an incident happens.
Source and legal limits
The FTC Start with Security guide discusses practical security lessons, including limiting collection, access, retention, and oversight of service providers. It is regulator guidance, not a finding that any vendor meets every applicable law.
What can go wrong
A vague promise can leave both teams unsure what to implement or test. A customer may assume a certification covers a system or period that it does not. Security and liability provisions can allocate different responsibilities.
A focused negotiation
Request a scoped security exhibit, appropriate evidence, incident contacts and a notice process. Confirm which systems and subprocessors are covered. Avoid putting raw credentials, personal data, or sensitive reports into negotiation notes.
Sources and scope
FTC — Start with Security: A Guide for Business
Regulator security guidance and enforcement lessons; not a complete compliance checklist or contract mandate.
Put the checklist to work.
Choose a role and review the exact outbound text before requesting analysis. Live analysis is limited to eligible invited accounts; model and legal acceptance remain pending.
Open the review workspace Explore a local sample