Contracts and SLAs (Service Level Agreements) include a security clause
Many people are involved in an organization, including external suppliers of goods and services, and their own employees. It is important that everyone follows the same security rules.
All contracts with external suppliers need to contain security clauses in order to comply with the GDPR. It is also an opportunity to include other elements to ensure that security is not marginalized.