Make demands before the contract is concluded. Ask about jurisdiction, ownership, data locations, subcontractors, remote management, key management, open standards, export formats, audit rights, continuity and termination.
Also record how evidence is provided and how changes are reported. A quality mark or general marketing claim does not replace a verifiable agreement. Use the ECSF objectives and SEAL levels as a common language where appropriate.