Does your organization include specific cybersecurity risk management provisions in contracts and agreements with suppliers and their supply chains?
Explanation
Contractual supply chain provisions are what's being checked: whether your supplier agreements spell out cybersecurity responsibilities and liabilities across the chain.
Contracts should clearly define who is responsible for security incidents, data breaches, vulnerability management, and compliance requirements throughout the relationship lifecycle.
Including these provisions helps establish accountability and ensures all parties understand their security obligations.
Evidence could include sample contract templates or redacted agreements showing cybersecurity clauses, supplier security requirements documentation, or a formal supply chain risk management policy that mandates the inclusion of security provisions in all supplier contracts.
Implementation Example
Specify in contracts and other agreements the rights and responsibilities of the organization, its suppliers, and their supply chains, with respect to potential cybersecurity risks
ID: GV.SC-05.093
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Related questions
- Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?
- Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?
- Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?
- Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?
- Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?
- Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?