CyberSec Update #36: Cybersecurity Clauses in Contracts | KWKR

CyberSec Update: A Cybersecurity Clause in a Contract, or the Border Wall Dispute

“The wall collapsed, and with it came reconciliation.” Fredro’s The Revenge revolves around a single issue: a section of wall on the boundary between two estates that nobody wants to repair and everyone argues about. Cześnik and Rejent know perfectly well where one property ends and the other begins. The problem is that they never agreed on who was responsible for the border.

It is a surprisingly accurate metaphor for modern cybersecurity. Consistent with the spirit of our series, we view the next issue through this very lens. Most security incidents do not originate at the core of a system but at the point where an organisation meets its contractor, where “our” infrastructure ends and “their” access begins. A cybersecurity clause is nothing more than a contractual border wall and, above all, a clear answer to the question of who is responsible for protecting it.

Why Is a Cybersecurity Clause Important?

A cybersecurity clause extends security standards beyond the organisation itself and into its relationships with contractors. Its importance increases wherever the scale and sensitivity of information are greatest, including:

• large infrastructure projects and investments of strategic importance;
• complex public procurement projects, where public sector entities are responsible for service continuity;
• situations in which supply chain security forms a key part of the risk management obligations imposed on essential and important entities.

This is precisely the “wall” that Fredro’s protagonists lacked.

What Should a Cybersecurity Clause Provide?

A well-drafted cybersecurity clause establishes a minimum and consistent set of organisational and technical security requirements for contractors. These may include:

• the obligation to report security incidents within clearly defined contractual deadlines;
• continuous monitoring of security events proportionate to the scope of access granted;
• regular vulnerability testing and remediation within specified timeframes;
• for higher-risk suppliers: multi-factor authentication (MFA), the principle of least privilege, periodic review and revocation of access rights, and data encryption;
• certification, such as ISO/IEC 27001, or equivalent evidence of cybersecurity maturity.

Which Risks Does a Cybersecurity Clause Mitigate?

A cybersecurity clause addresses risks that can directly disrupt projects and business operations, including:

• security incidents and their escalation within a contractor’s environment;
• data breaches, including personal data and particularly sensitive information;
• disruptions to the continuity of operationally significant systems;
• supply chain risks, including the use of components from so-called high-risk suppliers.

Cybersecurity Clauses and Allocation of Responsibility

The essence of a well-designed cybersecurity clause is the clear allocation of roles and responsibilities in advance. Unlike Cześnik and Rejent, the parties should know from the outset who is responsible for what.

• allocation of responsibilities, including who reports what and within which timeframe;
• incident reporting mechanisms, including dedicated communication channels and reporting formats;
• audit rights, enabling documentary and technical verification;
• contractual sanctions, ideally graduated from formal breaches through security breaches to critical violations that justify termination.

The Principle of Proportionality: The Heart of an Effective Clause

Security requirements should be tailored to the nature, scale and risk level of a particular engagement.

A crucial distinction should be made:

• the size of an enterprise may influence how compliance is demonstrated, for example through simplified documentation for SMEs;
• however, it should not reduce the actual level of security required, which must be determined by the assigned risk category.

As a result, the clause does not become disproportionately burdensome for smaller entities while still providing robust protection where the stakes are highest.

Compliance with the KSC Act and NIS2

A cybersecurity clause serves as a practical mechanism for implementing obligations arising from the National Cybersecurity System Act (KSC) and the NIS2 Directive. In particular, it supports:

• the implementation of security management systems and proportionate technical and organisational measures;
• supply chain security management and incident handling processes;
• the oversight responsibilities of management bodies with respect to cybersecurity risk management.

Important: contractual incident reporting deadlines do not replace statutory reporting obligations to the competent CSIRT. Both regimes operate in parallel.

GDPR: The Bridge Between Information Security and Data Protection

Where personal data is involved, a cybersecurity clause naturally complements Article 32 of the GDPR, which requires controllers and processors to implement appropriate technical and organisational measures based on risk.

In practice, this means that:

• the security requirements defined in the clause constitute a minimum standard for personal data protection as well;
• issues relating specifically to personal data processing are governed by a separate Data Processing Agreement (DPA).

What Comes Next?

The moral of The Revenge is that reconciliation arrives only after the dispute over the wall has already caused damage. In cybersecurity, this is not a sequence worth repeating. Boundaries of responsibility should be defined before a tender or contract is signed, rather than after an incident occurs.

A cybersecurity clause is precisely such a wall: established in advance and scaled according to risk.

In the next edition, we will look at how to build contractor risk categories in practice and tailor requirements accordingly, ensuring that cybersecurity clauses are rigorous where necessary and proportionate where appropriate.

How does your organisation protect the border wall between itself and its suppliers?