reviews and provides recommended information security language for client and thirdparty contracts to include specific security control requirements where applicable, specialized reporting and response procedures in the event of an incident, selfcertification procedures, and audit rights definitions.