A manufacturing company is preparing to sign a master services agreement with a third-party support vendor whose engineers will hold remote administrative access to production control systems. The procurement lead asks the security manager which clause matters MOST to include in the vendor contract from a personnel security perspective.
- AA requirement that the vendor carry cyber liability insurance with a minimum coverage limit, to compensate the company if a vendor employee causes a breach.
- BA clause obliging the vendor to apply background screening, onboarding, and offboarding controls to its assigned personnel that are equivalent to the company's own internal policy, with notification when assigned staff leave. Correct
- CA right-to-audit clause permitting the company to inspect the vendor's premises and systems on reasonable notice once per year.
- DA confidentiality clause requiring each vendor engineer to sign a non-disclosure agreement before being assigned to the account.
Why A is wrong: Insurance transfers some financial loss after the fact but does not reduce the probability of a personnel incident. It is a useful contract term but it is downstream of the actual controls on who the vendor allows near the production systems.
Why B is correct: This flows the personnel security baseline through the supply chain. It sets a measurable standard the vendor must meet for any individual touching the production systems, and the leaver notification clause closes the gap where the vendor's offboarding never reaches the company's access reviews. It is the manager-level control on which the other clauses depend.
Why C is wrong: Annual audits are a deterrent and a verification mechanism, but on their own they do not specify what good looks like. Without a separately defined standard for vendor personnel, an auditor walks in with nothing concrete to test against.
Why D is wrong: Non-disclosure agreements address what an engineer is permitted to say about what they see, not who the vendor is permitted to send. They are necessary, easy to obtain, and commonly already present, but they leave the screening and offboarding gaps untouched.