information security language for client and third-party contracts to include: where applicable; 2) specialized reporting and response procedures in the event of an incident; 3) self-certification procedures; and 4) right-to-audit definitions.