6.1.3 The relevant entities shall review and, where appropriate, update the processes at planned …

Requirement

The relevant entities shall review and, where appropriate, update the processes at planned intervals and when significant incidents occur.

Guidance

• Review the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, at least annually.
• Review logs or records of all changes made to the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, including details of the changes, approvals and implementation dates.
• Align the tenders and contracts with the entity’s supply chain security policy (Annex to the regulation, point 5.1).
• For ICT services, systems or products that are not provided by a supplier (e.g. open source projects), entities should share relevant results from internal assessments with them.

Examples of evidence

• Review plans or schedules for processes for secure acquisition of ICT services, systems or products, and the procedures based on them.
• Minutes from reviews or possible changes made to the processes for ICT services, system or product acquisition, and the procedures based on them, including actions taken to enhance security in future acquisitions.
• Documented results of possible auditing activities, indicating compliance with internal secure acquisition of ICT services, systems or products processes and external regulations.
• Change management records of changes made to the processes for secure acquisition of ICT services, systems or products, and the procedures based on them, including documentation of the review and approval process.
• Incident response records that confirm whether the entity takes into account significant incidents when reviewing and updating the processes and procedures for secure acquisition of ICT services, systems or products.

Tips: guidance

• Apply the secure acquisition of ICT systems or product processes and relevant procedures to both software and hardware products, regardless of whether they were developed in-house or acquired.
• Continuously monitor suppliers or service providers with regard to points 5.1.6 and 5.1.7 of the Annex to the regulation so that they are aligned with the supply chain security policy.
• In addition to the elements referred to in point 6.1.2 of the Annex to the regulation , consider the following when formulating tenders with cybersecurity in mind (indicative, non-exhaustive list):
  • ensure continuous alerting, patching and mitigation proposals if vulnerabilities in the system or the product are discovered;
  • clarify the supplier’s or service provider’s liability in the event of cyber-attacks or incidents relevant to the service, system or product; and
  • consider cybersecurity during project implementation and before handover including (indicative, non-exhaustive list):
    • design reviews;
    • acceptance tests;
    • commissioning tests;
    • site acceptance tests; and
    • documentation.
• Make sure that secure decommissioning service providers involve considerations such as deactivating user and service accounts, terminating data flows and ensuring the secure disposal of the entity’s data within supplier or service provider systems.
• Free and open-source software is often obtained free of charge from communities and projects developing, maintaining and distributing software, as opposed to purchased from suppliers or service providers. When using such software without purchase, relevant entities cannot impose obligations for compliance beyond the adherence to the terms of the open source software license. Beyond that, it is good practice to apply the guidance of section 6.1.

Tips: examples of evidence

• Evidence that internal (in-house) projects consider and prioritize security when acquiring ICT services, systems or product processes.
• Evidence that points 5.1.6 and 5.1.7 of the Annex to the regulation are implemented.
• Tenders that contain elements in addition to those referred to in point 6.1.2 of the Annex to the regulation.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -