5. Supply chain security

Mapping to standards and frameworks

Requirement

The relevant entities shall maintain and keep up to date a registry of their direct suppliers and service providers, including: (a) contact points for each direct supplier and service provider; (b) a list of ICT products, ICT services and ICT processes provided by the direct supplier or service provider to the relevant entities.

Guidance

• Keep the registry up to date to ensure all information is current and accurate, that is, add, update and remove suppliers and service provider from the registry in the event of changes.
• Conduct reviews of the registry, at least annually or when significant changes occur to ensure all information is current and accurate.

Examples of evidence

• Registry of direct suppliers and service providers.
• Evidence of registry updates following direct supplier and service provider changes.
• Review plans or schedules.

Tips: guidance

• In addition to the elements referred to in point 5.2 of the Annex to the regulation consider the start and end dates of the contract and the region of each direct supplier and service provider.
• Classify direct suppliers and service providers. The classification may include one or more characteristics (indicative, non-exhaustive list):
  • sensitivity of assets purchased,
  • volume of assets purchased,
  • availability requirements,
  • applicable regulations,
  • inherent risk and mitigated risk.
• Update and review classifications annually or when significant changes occur. Examples of categories may be:
  • critical – those with a significant impact on the entity’s operations;
  • strategic – high-value partners who contribute to information assets, for example cloud providers, data analytic providers, software developers and telecommunication providers;
  • routine – those with minimal impact on the entity.

Tips: examples of evidence

• List of relevant contracts or SLAs that are in line with the documented supply chain policy.
• Evidence that the entity has categorised its direct suppliers and service providers based on criteria.
• A clear description of how direct suppliers and service providers are grouped and managed based on their importance and risk level.
• Evidence that the entity assesses risks associated with each direct supplier and service provider category, and that it tailors measures accordingly. For instance, ‘critical’ direct suppliers and service providers receive more attention and customised policies.

Mapping to standards and frameworks