GV.SC-05.092
Does your organization require suppliers to provide evidence of their security practices through formal attestation, certification, or inspection processes?
Explanation
This question assesses whether your organization has formal mechanisms to verify that suppliers maintain adequate security controls. By requiring evidence such as SOC 2 reports, ISO 27001 certifications, completed security questionnaires, or allowing security inspections, you can validate that third parties handling your data meet your security standards. Evidence could include supplier contracts with security requirements clauses, a supplier security assessment program document, collected attestations or certifications from key suppliers, or a supplier management policy that outlines security verification requirements.
Implementation Example
Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections
ID: GV.SC-05.092
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
