SSP-3 Contract clauses for Tier 1

A Tier 1 contract carries all of C1 to C6: C1 security requirements; C2 notification to us of any security incident affecting our information within 48 hours of the supplier becoming aware; C3 right to audit or an annual independent assurance report; C4 our prior approval of subcontractors who handle our information; C5 return and deletion of our information at exit; C6 confidentiality.

The SPECIMEN organisation's own procedure (in the scenario inputs, supplier-security-procedure.md); no external clause decides this step.