5.1. Supply chain security policy

(a)

the cybersecurity practices of the suppliers and service providers, including their secure development procedures;

(b)

the ability of the suppliers and service providers to meet cybersecurity specifications set by the relevant entities;

(c)

the overall quality and resilience of ICT products and ICT services and the cybersecurity risk-management measures embedded in them, including the risks and classification level of the ICT products and ICT services;

(d)

the ability of the relevant entities to diversify sources of supply and limit vendor lock-in, where applicable.

(a)

cybersecurity requirements for the suppliers or service providers, including requirements as regards the security in acquisition of ICT services or ICT products set out in point 6.1;

(b)

requirements regarding awareness, skills and training, and where appropriate certifications, required from the suppliers’ or service providers’ employees;

(c)

requirements regarding the verification of the background of the suppliers’ and service providers’ employees;

(d)

an obligation on suppliers and service providers to notify, without undue delay, the relevant entities of incidents that present a risk to the security of the network and information systems of those entities;

(e)

the right to audit or right to receive audit reports;

(f)

an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;

(g)

requirements regarding subcontracting and, where the relevant entities allow subcontracting, cybersecurity requirements for subcontractors in accordance with the cybersecurity requirements referred to in point (a);

(h)

obligations on the suppliers and service providers at the termination of the contract, such as retrieval and disposal of the information obtained by the suppliers and service providers in the exercise of their tasks.

(a)

regularly monitor reports on the implementation of the service level agreements, where applicable;

(b)

review incidents related to ICT products and ICT services from suppliers and service providers;

(c)

assess the need for unscheduled reviews and document the findings in a comprehensible manner;

(d)

analyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers and, where appropriate, take mitigating measures in a timely manner.