Contract review against a security annex: documents to prepare
A review against a security annex checks whether the main contract and its security schedule agree on encryption, incident notice, audit rights and sub-processor rules. Preparing five documents before the review starts — the annex, the main contract, an asset inventory, an incident log and a sub-processor list — turns a multi-week exchange into a matter of days.
What changes in timing and risk
A security annex sits next to the main contract but rarely gets read at the same pace. Commercial terms move first; the annex is often signed as an afterthought, with wording copied from an earlier deal. That gap becomes a problem the moment an incident happens or an audit is requested, because the annex and the contract may promise different things.
The practical effect is timing risk. If the review starts without the underlying documents, each missing item triggers a new request to the other side, and each request adds days. A vendor that senses disorganisation on your part also negotiates harder on the clauses that matter: notice windows, audit scope, liability for a breach traced to a sub-processor.
Preparing documents before the first exchange removes most of that friction. It also gives your negotiator a fixed reference point, so the discussion stays on substance rather than on reconstructing what was actually agreed two contract cycles ago.
Documents to prepare
The table below lists what a reviewer needs before opening the annex. Missing rows are the most common cause of delay in this type of review.
| Document | Purpose | Provided by |
|---|---|---|
| Current security annex | Baseline text the review measures against | Contract owner |
| Main contract, current version | Checks that commercial and security terms do not contradict each other | Contract owner |
| Asset and data-flow inventory | Shows what systems and data the annex is actually meant to cover | IT or security lead |
| Incident log, last twelve months | Tests whether notice and remediation clauses were followed in practice | Security team |
| Sub-processor and sub-contractor list | Confirms consent requirements and flow-down obligations were respected | Vendor or procurement |
| Prior audit reports, if any | Gives the reviewer a starting point instead of a blank inventory | Security team |
None of these documents needs to be perfect. A partial asset inventory is still faster to correct than one built from scratch during the review.
Steps to run the review
- Assign a single owner. The contract owner names one person who collects documents and answers questions; without this, requests scatter across teams and nothing moves.
- Pull the annex and the contract together. The contract owner retrieves the signed versions of both, not drafts, and confirms which amendment is current.
- Build the asset and data-flow inventory. The IT or security lead lists systems, storage locations and data types covered by the annex, even where the list is incomplete.
- Compile the incident log. The security team pulls every entry from the last twelve months, including near-misses that did not trigger formal notice.
- Confirm the sub-processor list. Procurement checks it against the annex's consent clause and flags any party added without written approval.
- Send the package for legal review. The reviewer compares each document against the annex clause by clause and marks gaps for negotiation.
Who decides and how long it takes
The review itself does not produce a binding decision; it produces a gap list. Sign-off on that list sits with whoever owns the vendor relationship internally, usually the procurement lead or the person who holds budget authority for the contract. Where the annex covers sensitive systems, a security lead co-signs before the gap list goes back to the vendor.
With the documents above in hand, the technical comparison typically takes a few working days. Without them, the same review stretches over several weeks, because each missing document becomes a separate request cycle with the vendor or with an internal team.
Common forks
If the annex references a sub-processor that does not appear on your own vendor list, the review pauses there. The gap goes back to procurement before the rest of the annex is checked, because the missing consent affects every other clause downstream.
If the incident log shows a past breach with no recorded notice under the annex's timeline, the review flags this as a standing exposure rather than a historical footnote. It is raised with the vendor separately from the general document comparison.
If the main contract and the annex conflict on a material point — audit frequency is a common example — the review does not resolve which document controls. That question goes to whoever negotiated the original deal, with both texts attached.
Related reading
A related procedure covers the clause most often renegotiated once an annex review is complete: Negotiating limitation of liability: documents to prepare. It uses the same document-first approach, adjusted for a different clause.
Sources and limits
This page does not decide who owns liability once a gap is found; that question is handled through the limitation-of-liability procedure referenced above. It also does not extend to personal data claims raised by an individual named in a vendor's own records. If you are named in a report and what to do next is described separately: If you are named in a report and what.
A security annex review often runs alongside due diligence on the counterparty itself. Where a written report on the other party already exists, its scope and limits are set out on its own page, for example Counterparty in Netherlands and its limits in practice.
Where the review turns on a specific document rather than the counterparty as a whole, a separate report format applies, with its own deadline for delivery: Document in Germany and the deadline.
Checked: current calendar year. This page describes an internal review procedure and does not cite statutory provisions; it should be read alongside your own contract templates rather than as a substitute for them.
FAQ
How long does contract review against a security annex take in practice?
With the six documents above prepared in advance, the comparison itself typically runs a few working days. Missing documents add a separate request cycle for each gap, which is what usually stretches the timeline to several weeks.
Which documents are needed to start?
The current annex, the main contract, an asset and data-flow inventory, a twelve-month incident log, a sub-processor list and any prior audit reports. A partial version of each is still enough to begin.
What happens if the other side does not respond?
The gap list stands as drafted, and the internal owner escalates through the commercial relationship rather than waiting indefinitely. A non-response is itself treated as a fact for the negotiation, not as a reason to pause the review.
Ready to move from checklist to negotiation? When a marketplace delists the collection step by step shows how a document-first approach applies once a dispute is already moving.