Does your organization have a formal process to collect and evaluate evidence of third-party compliance with contractual cybersecurity requirements?
Explanation
Verifying third-party compliance is the concern here: the question is whether you have a formal process to collect and evaluate evidence that vendors meet their contractual cybersecurity obligations. This includes collecting and evaluating documentation such as self-attestations, warranties, certifications (like SOC 2, ISO 27001), audit reports, and security questionnaire responses from vendors and partners.
Evidence of fulfillment could include a documented third-party compliance verification process, a vendor management system that tracks compliance artifacts, sample compliance review reports, or a register of third-party certifications with expiration dates and compliance status.
Implementation Example
Evaluate third parties' evidence of compliance with contractual cybersecurity requirements, such as self-attestations, warranties, certifications, and other artifacts
ID: GV.SC-07.099
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
Related questions
- Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?
- Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?
- Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?
- Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?
- Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?
- Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?