5.1.6 The relevant entities shall review the supply chain security policy and monitor, evaluate and …

Requirement

The relevant entities shall review the supply chain security policy and monitor, evaluate and, where necessary, act upon changes in the cybersecurity practices of suppliers and service providers, at planned intervals and when significant changes to operations or risks or significant incidents related to the provision of ICT services or having impact on the security of the ICT products from suppliers and service providers occur.

Guidance

• Review the supply chain policy at least annually.
• Create and maintain a process to monitor suppliers and service providers over the life cycle.

Examples of evidence

• Supply chain policy review plans or schedules.
• Records from previous reviews.
• List of security incidents related to or caused by engagement with a supplier or service provider.
• Evidence that the policy was reviewed and possibly updated, after significant changes to operations or risks or significant incidents related to the provision of ICT services or having an impact on the security of the ICT products from suppliers and service providers.
• Evidence from evaluations of suppliers and service providers.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -