For example, if your partner objects to security requirements because of cost, offer to share some of the cost. A partner "might balk at an extra few hundred dollars to pay for the setup of an extra server," says Calaceto. "In some cases we’ll absorb it because we want a more secure system."

Or you can offer to include your partners in your security software licensing agreements to save them a few bucks, says Le Grand. Here Bedard advocates a "matching fund," where a company offers to kick in a dollar for every dollar its partner spends complying with the requirements.

Finally, Gaffney suggests offering discounts or preferred-seller status to partners that accept your requirements. "If a company associates economic value [with its requirements], it needs to be part of the negotiation," he says.

The Stick

Enforcement is an issue that companies should plan for in advance, with the hope of never having to exercise the stipulated penalties. The best way to enforce security requirements is to establish them in your B2B engagement contract. That provides a specifically delineated recourse should the partner fail to implement sound security measures. According to ISC2’s Morrow, the ideal recourse against a lax partner is indemnification?an agreement that if you get sued for damage caused by your partner’s breach, the partner will pay you back the amount of the judgment. Of course, that requires proving that your partner was truly responsible.

On a case-by-case basis, Staples will provide in its B2B contracts that the partner will indemnify Staples for damage or legal liability stemming from the partner’s security lapses. But Gaffney says such a provision can be tough to secure. "The bigger companies?particularly larger software providers?tend to stick hard to holding back on indemnification," says Gaffney, adding that smaller companies might agree to indemnification in return for more favorable pricing or product distribution.

Another form of recourse is a liquidated damages clause?a contract provision stating that a partner that doesn’t live up to its security obligations (resulting in contract cancellation) will pay the other partner a set amount of money.

Finally, if a partner violates the contract by, say, failing the audit, you have the right to terminate it. But think twice about applying these sticks just because your partner has fallen short on an audit or failed to meet a particular requirement, especially if you haven’t been harmed as a result. The ultimate objective of your B2B engagement is a productive, profitable relationship. The minute you seek to terminate the contract or collect fines, you’ve likely destroyed the relationship. You’re much better off working with the partner to remedy its lapses, ensuring a safer and more profitable partnership for the future.