This is very common in boilerplate enterprise contracts. They will often have provisions about compliance with certain security and disaster recovery standards.