Has your organization defined specific security requirements in service-level agreements (SLAs) that allow for monitoring supplier security performance throughout the relationship lifecycle?

This question assesses whether your organization has established clear security metrics, performance indicators, and compliance requirements within your supplier SLAs. These defined requirements create accountability and provide a framework for ongoing security monitoring of third parties who may have access to your systems or data. For example, an SLA might specify required response times for security incidents, minimum security control standards, or compliance with specific regulations. Evidence could include sample SLAs with security clauses highlighted, a supplier security monitoring framework document, or reports showing regular security performance reviews against SLA metrics.