Vendor contracts must clearly specify security reporting requirements stating that the vendor is responsible for maintaining the security of confidential data regardless of ownership so that accountability for data protection is explicit.

Contracts must clearly identify security reporting requirements

— Pyrana Vendor Management Policy.pdf

stipulate that the vendor is responsible for maintaining the security of confidential data

— Pyrana Vendor Management Policy.pdf

regardless of ownership

— Pyrana Vendor Management Policy.pdf