GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of …

Statement

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

Example

Establish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised

Example

Include all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language

Example

Define the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements

Example

Manage risk by including security requirements in agreements based on their criticality and potential impact if compromised

Example

Define security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle

Example

Contractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service

Example

Contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products

Example

Contractually require suppliers to vet their employees and guard against insider threats

Example

Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections

Example

Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final