Does your organization require suppliers to implement employee vetting procedures and insider threat controls in contractual agreements?

Supplier personnel risk is what's being assessed: whether your contracts require suppliers to vet their employees and put insider threat controls in place. Supplier employees often have access to your sensitive data or systems, and inadequate vetting by suppliers creates security vulnerabilities that could impact your organization.

Evidence of compliance could include sample contract language with security requirements, supplier security addendums that specifically address employee vetting and insider threat controls, or a supplier security policy that mandates these requirements in all supplier agreements.