6.1.1 For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities shall set and implement processes to manage risks stemming from the acquisition of ICT services or ICT products for components that are critical for the relevant entities’ security of network and information systems, based on the risk assessment carried out pursuant to point 2.1, from suppliers or service providers throughout their life cycle.

Guidance

• Integrate cybersecurity as a permanent component of the purchase process by dedicating a specific section to addressing it. This includes any acquisition processes for selecting FOSS (48).
• Document the process for secure acquisition of ICT services, systems or products and describe relevant procedures that support the process.
• Take into account industry-recognised standards when developing the process (49).

Examples of evidence

• Tender templates for the acquisition of ICT services, systems or products which address cybersecurity.
• Documented process which is based on relevant standards and good practices.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• ENISA -