Does your organization regularly monitor critical suppliers' compliance with security obligations through inspections, audits, tests, or other evaluation methods?
Explanation
Ongoing supplier oversight is what's assessed, namely whether you verify critical suppliers' security compliance through inspections, audits, tests, or comparable evaluations. Effective supplier monitoring helps identify security gaps before they lead to incidents and ensures continuous compliance with your security requirements.
Evidence could include a supplier monitoring schedule, recent audit reports of critical suppliers, documentation of security inspections, test results, or corrective action plans resulting from supplier evaluations. A comprehensive supplier security monitoring program typically includes defined evaluation criteria, scheduled assessment activities, and processes for addressing identified deficiencies.
Implementation Example
Monitor critical suppliers to ensure that they are fulfilling their security obligations throughout the supplier relationship lifecycle using a variety of methods and techniques, such as inspections, audits, tests, or other forms of evaluation
ID: GV.SC-07.100
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
Related questions
- Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?
- Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?
- Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?
- Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?
- Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?
- Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?