What it asks for. This control expects relevant information security requirements to be established and agreed with each supplier, based on the type of supplier relationship.
In practice. Good practice means contracts or agreements that state the security obligations of the supplier, such as access rules, protection of information, incident notification, use of subcontractors, right to audit or receive assurance and return or deletion of data at the end. The level of detail matches the risk of the relationship. Auditors expect contract templates or clauses, signed agreements for key suppliers and links to the supplier risk assessment.
Common gaps. Typical gaps are standard terms accepted from large cloud providers without review, missing incident notification clauses and no requirements on sub-processors.