5.1.2 As part of the supply chain security policy referred to in point 5.1.1, the relevant entities shall …

Requirement

As part of the supply chain security policy referred to in point 5.1.1, the relevant entities shall lay down criteria to select and contract suppliers and service providers. Those criteria shall include the following: (a)the cybersecurity practices of the suppliers and service providers, including their secure development procedures;

(b) the ability of the suppliers and service providers to meet cybersecurity specifications set by the relevant entities; (c) the overall quality and resilience of ICT products and ICT services and the cybersecurity risk-management measures embedded in them, including the risks and classification level of the ICT products and ICT services; (d) the ability of the relevant entities to diversify sources of supply and limit vendor lock-in, where applicable.

Guidance

• Consider criteria such as:
  • the legal jurisdiction of the supplier or service provider, for example whether the supplier is regulated under the NIS2 Directive or the Cyber Resilience Act and in which jurisdiction(s);
  • if available, compliance statements from the supplier in relation to the NIS2 Directive;
  • the corporate ownership of the supplier or service provider;
  • the supplier’s or service provider’s ability to ensure supply (e.g. size, reliance on other suppliers or service providers and degree of control over its own supply chain);
  • the cybersecurity practices of the supplier or service provider, and whether adequate prioritisation is given to cybersecurity practices, attested by:
    • industry standard certifications for cybersecurity;
    • vendor risk-management software reports or other provider assessment reports (e.g. Standardized Information Gathering, vendor security assessment or consensus assessment initiative questionnaire), if available;
  • notices or advice issued by national authorities on the selection of suppliers or service providers, if available;
  • the sensitivity of the use of the products and services acquired;
  • the supplier or service provider’s history in relation to cybersecurity events and breaches;
  • the possibility of vendor lock-in, if the supplier or service provider is selected. Parameters to consider are the use of open and interoperable standards, the use of open data formats, existing contracts with the supplier or service provider, the use of proprietary software features, etc.

Examples of evidence

• A policy containing the elements referred to in point 5.1.2 of the Annex to the regulation.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -