Vendor contracts must clearly identify security reporting requirements stating that the vendor is responsible for maintaining the security of confidential data regardless of ownership.

Contracts must clearly identify security reporting requirements

— Pyrana Vendor Management Policy.pdf

the vendor is responsible for maintaining the security of confidential data

— Pyrana Vendor Management Policy.pdf

regardless of ownership

— Pyrana Vendor Management Policy.pdf