Start for free Start for free

Technical and Organizational Measures (TOMs)

Technical and organizational measures (TOMs) are the security steps a vendor promises to take to protect your data, such as encryption, access controls and staff training. They are usually listed in an annex to the DPA.

What are technical and organizational measures?

Technical and organizational measures, or TOMs, are the security steps a vendor promises to take to protect your data. They are usually listed in an annex to the data processing agreement (DPA).

"Technical" covers systems, such as encryption, access controls and backups. "Organizational" covers people and process, such as staff training, background checks and incident response plans.

The requirement comes from the GDPR, the EU privacy law. Article 28(3)(c) says the vendor must take the measures required by Article 32. Article 32 lists examples such as encryption, keeping systems available and resilient, restoring data after an incident, and regular testing.

In the EU model contract clauses, this list is Annex II. The European Commission's Q&A says the parties should describe the measures actually in place, not copy every example.

A real example: Atlassian's Security Measures page is linked from its DPA as Annex II. It has 20 numbered sections, from access control to supply chain risk management.

A real change we caught

TOMs are not fixed. Venpo flagged that Splunk took background checks out of two security exhibits. A background check is an organizational measure, so removing it changes what the vendor promised about who can reach your data.

Why it matters to you

TOMs are the vendor's security promise in writing. If a breach happens, the question is often whether the vendor did what its TOMs said.

Many vendors keep the right to update them. Atlassian's DPA lets it change its Security Measures, as long as the change does not materially decrease overall security. That leaves room for judgment about what counts as material.

Your own customers may ask about your vendors' security in a security questionnaire. Your answers are only as current as the TOMs you last read.

What to check

  • Find the TOMs annex or linked page and save a dated copy.
  • Check whether the vendor can change it, and on what condition.
  • Compare the current version with your saved copy, heading by heading, using a redline.
  • Look for removed items, not only added ones: a deleted line is easy to miss.
  • Check that the TOMs match what the vendor's SOC 2 report covers.

How Venpo helps

Venpo monitors your vendors' DPAs and linked security pages and emails you a plain-English alert when a measure is added or removed. The change history for each vendor shows what the page said before.

Start for free

Frequently asked questions

Can a vendor change its security measures without telling me?

Sometimes, within limits. Some DPAs, such as Atlassian's, allow updates as long as overall security is not materially reduced, so check whether yours promises to tell you about each change.

Is a TOMs annex the same as a SOC 2 report?

No. TOMs are the vendor's own written promises in the contract, while a SOC 2 report is an independent auditor's opinion on the vendor's controls.

Related terms

Vendor Documents Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies. Vendor Documents Security Addendum A security addendum is the part of a contract that lists the security controls a vendor promises to keep, such as encryption, access control and incident response. Unlike a security marketing page, it is a binding promise. Subprocessors and DPAs GDPR Article 28 GDPR Article 28 is the EU privacy law rule that says what must be in the contract between a business and a vendor that handles personal data for it. That contract is usually called a data processing agreement, or DPA. Security and Compliance Encryption at Rest and in Transit Encryption in transit protects data while it moves between systems, usually with TLS. Encryption at rest protects data while it is stored on disks or in databases, often with AES-256. Vendors describe both in their security terms. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Change Monitoring Redline (Document Comparison) A redline is a version of a document that marks exactly what changed, with additions highlighted and deletions struck through, used both to negotiate contracts and to compare an old and new version of a vendor's terms.

Sources

Last reviewed