When a security addendum arrives with the order form: what to do first
Stop before signing. Route the addendum to whoever owns technical security and to whoever owns the contract, separately, on the same day. Check whether the order form still matches the master agreement once the addendum sits on top of it. Do not treat the addendum as boilerplate: it usually adds obligations, deadlines and audit rights that the master agreement never mentioned.
Basis
A security addendum usually appears because someone in the chain now sits under a supply-chain security duty. That duty did not exist when the master agreement was signed. Directive (EU) 2022/2555 (NIS2) requires essential and important entities to push security requirements onto their suppliers through contract. The addendum is that mechanism in practice, not an optional extra the vendor added on its own initiative. Where the addendum grants audit rights or access to source code, Directive 2009/24/EC sets a boundary the addendum cannot cross. It protects the supplier's computer program as such. An audit clause cannot be drafted as if that protection did not exist, and a vendor is entitled to refuse an audit scope that reaches into protected code beyond what security verification actually needs.
Practical consequence
Once the addendum is signed, its clocks run independently of the master agreement's clocks. Notification deadlines for security incidents often start on discovery, not on the date your team gets around to reporting internally. Miss that distinction and a breach notice can already be late before anyone inside your organisation has finished the internal review. Audit rights typically survive termination for a fixed period, usually longer than procurement teams expect when they first read the clause. Liability caps agreed for the commercial deal can be carved out for security breaches specifically, which changes your exposure more than the price clause ever will. If the addendum also authorises monitoring of staff or client data as part of its security controls, the vendor's justification for that monitoring needs its own assessment, separate from the contract review itself. See Legitimate interest assessment in detail for how that test is built.
What to do first
- Legal counsel pauses the signature and lists every clause that adds an obligation not present in the master agreement.
- The security or IT owner maps the addendum's requirements against controls already in place, and flags gaps in writing.
- Procurement checks the addendum against the master agreement for direct conflicts, particularly on liability and termination.
- If more than one group entity is bound by the order form, confirm which one is the actual counterparty to the addendum.
- Someone with authority to accept residual risk signs off on any gap the security owner could not close before signature.
- Record the acceptance or rejection of each disputed clause with a date, before the order form is countersigned.
Who decides
| Decision | Who decides | By when |
|---|---|---|
| Accept the addendum as drafted | Contract owner and security lead, jointly | Before the order form is countersigned |
| Escalate a disputed clause | Legal team, via internal escalation route | Within the internal review window your organisation sets |
| Accept residual risk on an unresolved gap | Risk owner or equivalent senior sign-off | Before signature, recorded in writing |
| Confirm the vendor's own security obligations | Vendor's compliance contact, on written request | Before signature; no statutory deadline applies to this step |
The split matters. A security team can approve controls, but it rarely has authority to accept the legal risk sitting behind them. Keep the two sign-offs separate on the record, even if the same meeting produces both.
Forks
If the order form also covers tokenised assets, resolve the ownership question before extending security duties over it. Mismatched rights make the addendum's audit clauses meaningless, since nobody can audit what the counterparty does not actually control. See When the buyer of a token is not the for that scenario in full.
If the addendum's security controls rely on AI-based monitoring or automated threat detection, treat any AI Act reference with caution. As of 4 March 2025, Regulation (EU) 2024/1689 (AI Act) is not yet generally applicable. Its main obligations take effect from 2 August 2026. A clause citing it as a current duty is describing the future, not the present, and should be flagged rather than accepted at face value.
If the addendum was sent to one legal entity but the order form is signed by another within the same group, do not assume the addendum travels automatically. Confirm in writing which entity is bound before treating the security terms as settled, particularly where the entities sit in different jurisdictions.
Sources and limit
This page addresses contract mechanics, not litigation strategy or regulatory filing. It does not tell you whether a specific vendor's certificate is genuine, or whether a specific incident triggers a notification duty in your jurisdiction. Both depend on facts this page cannot see.
Where the addendum is followed by questions about the counterparty itself, a factual check has its own boundary. See Counterparty in Estonia and its limits step by step for what such a check in Estonia can and cannot establish.
Where a dispute turns on a specific document referenced inside the addendum, the same caution applies before anyone relies on it as proof of anything. See Document in Estonia and its limits in practice for how far a document check goes before a lawyer needs to read the original.
Verified: 4 March 2025. Sources: Directive (EU) 2022/2555 (NIS2); Directive 2009/24/EC; Regulation (EU) 2024/1689 (AI Act).
Related situations
If the security addendum sits alongside a subcontracting clause that sends work abroad, treat the two together rather than reviewing each in isolation. See When the outsourcing provider subcontracts abroad step by step for that sequence.
A first response from a partner arrives within minutes during business hours. A practical read of your specific addendum follows once we have seen it in full, alongside the master agreement it attaches to.
FAQ
What is the first step when a security addendum arrives with the order form?
Pause the signature. Route the addendum to legal and to the security owner separately, on the same day, before anyone signs the order form itself.
Which deadline is already running?
Notification deadlines for security incidents usually start on discovery, not on internal reporting. Audit rights commonly survive termination for a set period stated in the addendum, longer than the master agreement's own survival clauses.
Who decides, and on what evidence?
The contract owner and the security lead decide jointly whether to accept the addendum, based on a written gap analysis against existing controls and against the master agreement. Residual risk needs a separate, senior sign-off before signature.