5.1.4 Based on the supply chain security policy and taking into account the results of the risk …

Requirement

Based on the supply chain security policy and taking into account the results of the risk assessment carried out in accordance with point 2.1. of this Annex, the relevant entities shall ensure that their contracts with the suppliers and service providers specify, where appropriate through service level agreements, the following, where appropriate: (a) cybersecurity requirements for the suppliers or service providers, including requirements as regards the security in acquisition of ICT services or ICT products set out in point 6.1.; (b) requirements regarding awareness, skills and training and where appropriate certifications, required from the suppliers’ or service providers’ employees; (c) requirements regarding the verification of the background of the suppliers’ and service providers’ employees; (d) an obligation on suppliers and service providers to notify, without undue delay, the relevant entities of incidents that present a risk to the security of the network and information systems of those entities; (e) the right to audit or right to receive audit reports; (f) an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities; (g) requirements regarding subcontracting and, where the relevant entities allow subcontracting, cybersecurity requirements for subcontractors in accordance with the cybersecurity requirements referred to in point (a); (h) obligations on the suppliers and service providers at the termination of the contract, such as retrieval and disposal of the information obtained by the suppliers and service providers in the exercise of their tasks.

Guidance

• Ensure that, in all relevant new and renewed contracts, the requirements from point 5.1.4 of the Annex to the regulation are included.
• When dealing with large suppliers and service providers consider one or more of the following measures (indicative, non-exhaustive list):
  • collective bargaining by teaming up with similar size organisations for purchasing products or services in bulk;
  • representation by an association of which the entity is a member of;
  • legal advice for reviewing and negotiating a contract;
  • negotiating specific clauses such as exit, pricing and SLAs (43);
  • suppliers that publicly publish their security, privacy or reliability commitments;
  • providers with standard certifications (e.g. ISO 27001, SOC 2);
  • trusted platforms or marketplaces that vet suppliers (e.g. app stores, SaaS directories, partner networks);
  • contract templates or free legal checklists from small business associations, NGOs or government sites;
  • tools/services that allow easy data export, monthly payments or no lock-in;
  • avoiding long-term commitments or vendor lock-in without clear exit strategies; and
  • a short list of alternatives in case the supplier becomes unavailable.

Examples of evidence

• Contracts that contain the elements referred to in point 5.1.4 of the Annex to the regulation.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• ENISA -