|
+GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of … |
GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of …StatementRequirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties GuidanceEstablish security requirements for suppliers, products, and services commensurate with their criticality level and potential impact if compromised GuidanceInclude all cybersecurity and supply chain requirements that third parties must follow and how compliance with the requirements may be verified in default contractual language GuidanceDefine the rules and protocols for information sharing between the organization and its suppliers and sub-tier suppliers in agreements GuidanceManage risk by including security requirements in agreements based on their criticality and potential impact if compromised GuidanceDefine security requirements in service-level agreements (SLAs) for monitoring suppliers for acceptable security performance throughout the supplier relationship lifecycle GuidanceContractually require suppliers to disclose cybersecurity features, functions, and vulnerabilities of their products and services for the life of the product or the term of service GuidanceContractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products GuidanceContractually require suppliers to vet their employees and guard against insider threats GuidanceContractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections GuidanceSpecify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks 1. Ħarsa ġenerali
1.1 Referenzi1.2 Rekwiżiti identifikati1.3 Regolamenti relatati2. Rekwiżiti identifikati
3. Regolamenti relatati
Kwistjonijiet marbuta |