Security requirements are formally included in contracts with all suppliers who handle company data or access systems
Binding security and data protection clauses in supplier contracts give A.5.19's risk requirements legal weight once the relationship is signed.
Requiring binding security and data protection clauses in every in-scope supplier contract is A.5.20's core requirement: write the expectations into the agreement itself.
The Sekit policy requires binding security clauses in every supplier contract, holding an outsourced developer to the written standards this ISO control expects a company to apply.