6.1 Security in acquisition of ICT services or ICT products

Requirement

For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities shall set and implement processes to manage risks stemming from the acquisition of ICT services or ICT products for components that are critical for the relevant entities’ security of network and information systems, based on the risk assessment carried out pursuant to point 2.1, from suppliers or service providers throughout their life cycle.

Guidance

• Integrate cybersecurity as a permanent component of the purchase process by dedicating a specific section to addressing it. This includes any acquisition processes for selecting FOSS (48).
• Document the process for secure acquisition of ICT services, systems or products and describe relevant procedures that support the process.
• Take into account industry-recognised standards when developing the process (49).

Examples of evidence

• Tender templates for the acquisition of ICT services, systems or products which address cybersecurity.
• Documented process which is based on relevant standards and good practices.

Requirement

For the purpose of point 6.1.1., the processes referred to in point 6.1.1. shall include: (a) security requirements to apply to the ICT services or ICT products to be acquired; (b) requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products or replacement after the end of the support period; (c) information describing the hardware and software components used in the ICT services or ICT products; (d) information describing the implemented cybersecurity functions of the ICT services or ICT products and the configuration required for their secure operation; (e) assurance that the ICT services or ICT products comply with the security requirements according to point (a); (f) methods for validating that the delivered ICT services or ICT products are compliant to the stated security requirements, as well as documentation of the results of the validation.

Guidance

• The security requirements must include at least the means to detect, monitor and protect against unauthorized changes of software and information.
• Ensure that support contracts cover the system life cycle and obsolescence management requirements, including the date until which the system must be supported and include continuous alerting.
• Favour vendors that provide clear end-of-life information and that plan to provide separate critical security fixes.
• Make sure that tenders request that suppliers or service providers provide tested solutions for security issues in legacy or new technologies free of charge and as soon as a relevant security issue becomes known.
• Consider also the following information describing implemented cybersecurity functions such as (indicative, non-exhaustive list):
  • the potential risks that could arise from acquiring the specific ICT service, system or product. This might involve penetration testing to identify threats, vulnerabilities and the potential impact on the entity’s operations;
  • potential security tools that already need to be in place, for example a firewall, an intrusion detection system, a SIEM or a EDR/XDR;
  • a specific security mechanism that might need to be in place, such as a specific encryption algorithm or a particular access control mechanism (e.g. MFA);
  • cybersecurity standards for the ICT service, system or product that the entity needs to comply with;
  • where appropriate, the required assurance level of the ICT product, system or service and the existence of a relevant certificate following the European Cybersecurity Scheme for ICT products based on Common Criteria (EUCC).
• Consider evaluating the security of an ICT service, system or product before acquisition (50).

Examples of evidence

• Past or ongoing tenders for acquiring ICT services, systems or products, that address cybersecurity by referring, as a minimum, to the elements outlined in point 6.1.2 of the Annex to the regulation.
• Comparison between selected contracts and the associated tenders to check whether the supply chain policy and particularly the elements referred to in points 5.1.4 and 5.1.5 of the Annex to the regulation, are taken into consideration.
• Records from security tests before acquiring an ICT system or product.
• Certificates, test reports or other supporting information for the ICT products or systems from suitably accredited conformity assessment bodies.

Requirement

The relevant entities shall review and, where appropriate, update the processes at planned intervals and when significant incidents occur.

Guidance

• Review the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, at least annually.
• Review logs or records of all changes made to the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, including details of the changes, approvals and implementation dates.
• Align the tenders and contracts with the entity’s supply chain security policy (Annex to the regulation, point 5.1).
• For ICT services, systems or products that are not provided by a supplier (e.g. open source projects), entities should share relevant results from internal assessments with them.

Examples of evidence

• Review plans or schedules for processes for secure acquisition of ICT services, systems or products, and the procedures based on them.
• Minutes from reviews or possible changes made to the processes for ICT services, system or product acquisition, and the procedures based on them, including actions taken to enhance security in future acquisitions.
• Documented results of possible auditing activities, indicating compliance with internal secure acquisition of ICT services, systems or products processes and external regulations.
• Change management records of changes made to the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, including documentation of the review and approval process.
• Incident response records that confirm whether the entity takes into account significant incidents when reviewing and updating the processes and procedures for secure acquisition of ICT services, systems or products.

Tips: guidance

• Apply the secure acquisition of ICT systems or product processes and relevant procedures to both software and hardware products, regardless of whether they were developed in-house or acquired.
• Continuously monitor suppliers or service providers with regard to points 5.1.6 and 5.1.7 of the Annex to the regulation so that they are aligned with the supply chain security policy.
• In addition to the elements referred to in point 6.1.2 of the Annex to the regulation , consider the following when formulating tenders with cybersecurity in mind (indicative, non-exhaustive list):
  • ensure continuous alerting, patching and mitigation proposals if vulnerabilities in the system or the product are discovered;
  • clarify the supplier’s or service provider’s liability in the event of cyber-attacks or incidents relevant to the service, system or product; and
  • consider cybersecurity during project implementation and before handover including (indicative, non-exhaustive list):
    • design reviews;
    • acceptance tests;
    • commissioning tests;
    • site acceptance tests; and
    • documentation.
• Make sure that secure decommissioning service providers involve considerations such as deactivating user and service accounts, terminating data flows and ensuring the secure disposal of the entity’s data within supplier or service provider systems.
• Free and open-source software is often obtained free of charge from communities and projects developing, maintaining and distributing software, as opposed to purchased from suppliers or service providers. When using such software without purchase, relevant entities cannot impose obligations for compliance beyond the adherence to the terms of the open source software license. Beyond that, it is good practice to apply the guidance of section 6.1.

Tips: examples of evidence

• Evidence that internal (in-house) projects consider and prioritize security when acquiring ICT services, systems or product processes.
• Evidence that points 5.1.6 and 5.1.7 of the Annex to the regulation are implemented.
• Tenders that contain elements in addition to those referred to in point 6.1.2 of the Annex to the regulation.