Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data.

For example:

  • Access management
  • Password management
  • Data encryption in storage
  • Data encryption in transmission
  • Audibility and right to audit
  • Destruction of data
  • Notice of Breach
  • Disclosure of any past breach valued in excess of $3,000 USD
  • Etc

That said, this is more oriented towards small-to-small companies; 50-150 people in each company.

  • 1
    I realize that that they are not exactly what you are looking for but the The SANS Institute policy templates might offer a starting point. After all the agreement you mention, when enacted, becomes "policy" for the organizations in the agreement.
    – jl01
    Jan 22, 2012 at 13:03
  • +1 @jl01: Thanks, guess before replying to your suggestion I wanted to confirm that this page is the page your talking about: "SANS: Information Security Policy Templates"
    – blunders
    Jan 22, 2012 at 17:11

2 Answers 2


One very common area where business contract to certain security practices is merchants contracting with credit card companies who require PCI compliance. Where both SOX and PCI compliance differ from your question is that the standard is set by an independent third party and the two contracting parties basically agree to abide by that independent standard.

Since the standard is objective and maintained by a third party, it is possible for someone to audit the firms for compliance, in fact most merchant agreements require PCI compliance testing.

While it may be overkill, you could have a contract requiring that your partner comply with either the NIST standards or Federal Information Processing Standards (FIPS). By writing simple language such as "Firm X warrants that it will comply with X standard" rather than trying to incorporate the provisions of a standard into the contract, resolution would be much simpler and less costly in the event of a breach or dispute because of trying to argue over what the provisions of the contract say, it becomes a simple matter of getting a third party expert familiar with the referenced standard to opine on compliance with that standard.

Finally you need not require compliance with the entire set of FIPS; for example you could reference FIPS 197 for data encryption and FIPS 112 for passwords.

  • +1 While not the answer I'm looking for, that being an agreement that stands on its own, your answer clearly shows effort and thought, and more importantly offers an opinion worth thinking over. Thanks for sharing!
    – blunders
    Feb 2, 2012 at 5:31

The policies you describe are similar to what are required for SOX. SOX policy templates can be purchased (example: http://www.psrinc.com/sox.htm). NIST has a number of documents that can help you here: http://csrc.nist.gov/groups/SMA/fasp/archive.html

  • Thanks, though guess I see these the same as jl01 suggest of what appears to be "SANS: Information Security Policy Templates"; though since he never confirmed that was he was talking about, I never replied stating, while a good alternative reference, security policy documents are not a business agreement, and often terms that would be enforceable internally are out of the scope of a business-to-business agreement.
    – blunders
    Jan 26, 2012 at 18:18
  • So, basically I agree they're of use, but disagree that this is an answer to the question. Am I missing something, or is your answer suggesting that such "Business-to-Business Security Disclosure and Agreement" to not exist, and that internal security policy are the best bet?
    – blunders
    Jan 26, 2012 at 18:20
  • +1 @securityishard: Following up to confirm you have no additional information or feedback, given the bonus is set to expire in 3 days. +1 for the attempt to answer the question, since oddly no one else has. Again, thanks!
    – blunders
    Jan 31, 2012 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .