Suppliers must certify they adhere to strict security standards including, but not limited to: cybersecurity and encryption, internal security controls, data destruction, processing integrity, confidentiality and privacy.