Does your organization require suppliers to provide evidence of their security practices through formal attestation, certification, or inspection processes?
Explanation
Supplier assurance is at issue: reviewers want to know whether you require suppliers to evidence their security practices through attestation, certification, or inspection. By requiring evidence such as SOC 2 reports, ISO 27001 certifications, completed security questionnaires, or allowing security inspections, you can validate that third parties handling your data meet your security standards.
Evidence could include supplier contracts with security requirements clauses, a supplier security assessment program document, collected attestations or certifications from key suppliers, or a supplier management policy that outlines security verification requirements.
Implementation Example
Contractually require suppliers to provide evidence of performing acceptable security practices through, for example, self-attestation, conformance to known standards, certifications, or inspections
ID: GV.SC-05.092
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Related questions
- Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?
- Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?
- Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?
- Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?
- Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?
- Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?
