Big companies have procurement departments that use supplier contracts that contain clauses like this (from an actual big company supplier agreement (presented as "non-negotiable") for the purchase of off-site services, and one that already imposes robust confidentiality obligations on the supplier):
Supplier will: (a) designate one employee to be in charge of Supplier’s information security program; (b) maintain adequate physical security of all premises in which BIGCO Information will be processed and/or stored including that physical media containing such records is stored in locked facilities, storage areas or containers; (c) implement reasonable precautions with respect to the employment of, and access given to, Supplier personnel and contractors, including background checks; screening; security clearances that assign specific access privileges to individuals; training and security awareness programs for personnel and contractors; monito
