6.1.2 For the purpose of point 6.1.1., the processes referred to in point 6.1.1. shall include: (a) …

Requirement

For the purpose of point 6.1.1., the processes referred to in point 6.1.1. shall include: (a) security requirements to apply to the ICT services or ICT products to be acquired; (b) requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products or replacement after the end of the support period; (c) information describing the hardware and software components used in the ICT services or ICT products; (d) information describing the implemented cybersecurity functions of the ICT services or ICT products and the configuration required for their secure operation; (e) assurance that the ICT services or ICT products comply with the security requirements according to point (a); (f) methods for validating that the delivered ICT services or ICT products are compliant to the stated security requirements, as well as documentation of the results of the validation.

Guidance

• The security requirements must include at least the means to detect, monitor and protect against unauthorized changes of software and information.
• Ensure that support contracts cover the system life cycle and obsolescence management requirements, including the date until which the system must be supported and include continuous alerting.
• Favour vendors that provide clear end-of-life information and that plan to provide separate critical security fixes.
• Make sure that tenders request that suppliers or service providers provide tested solutions for security issues in legacy or new technologies free of charge and as soon as a relevant security issue becomes known.
• Consider also the following information describing implemented cybersecurity functions such as (indicative, non-exhaustive list):
  • the potential risks that could arise from acquiring the specific ICT service, system or product. This might involve penetration testing to identify threats, vulnerabilities and the potential impact on the entity’s operations;
  • potential security tools that already need to be in place, for example a firewall, an intrusion detection system, a SIEM or a EDR/XDR;
  • a specific security mechanism that might need to be in place, such as a specific encryption algorithm or a particular access control mechanism (e.g. MFA);
  • cybersecurity standards for the ICT service, system or product that the entity needs to comply with;
  • where appropriate, the required assurance level of the ICT product, system or service and the existence of a relevant certificate following the European Cybersecurity Scheme for ICT products based on Common Criteria (EUCC).
• Consider evaluating the security of an ICT service, system or product before acquisition (50).

Examples of evidence

• Past or ongoing tenders for acquiring ICT services, systems or products, that address cybersecurity by referring, as a minimum, to the elements outlined in point 6.1.2 of the Annex to the regulation.
• Comparison between selected contracts and the associated tenders to check whether the supply chain policy and particularly the elements referred to in points 5.1.4 and 5.1.5 of the Annex to the regulation, are taken into consideration.
• Records from security tests before acquiring an ICT system or product.
• Certificates, test reports or other supporting information for the ICT products or systems from suitably accredited conformity assessment bodies.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• ENISA -