Does your organization have a formal process for sharing vulnerability information with suppliers as specified in contractual agreements?
Explanation
Supplier-facing vulnerability sharing is what's examined: whether a formal process governs how you pass vulnerability information to suppliers as contracts require.
Effective vulnerability information sharing helps both parties address security issues promptly, reducing the risk window and potential impact of vulnerabilities in the supply chain.
This includes sharing details about newly discovered vulnerabilities, mitigation strategies, and coordinated response actions.
Evidence could include documented vulnerability sharing procedures, supplier contract clauses specifying information sharing requirements, communication logs demonstrating vulnerability information exchange, or a secure portal/platform used for sharing vulnerability information with suppliers.
Implementation Example
Conduct vulnerability information sharing between the organization and its suppliers following the rules and protocols defined in contracts
ID: ID.RA-08.173
Context
- Function
- ID: IDENTIFY
- Category
- ID.RA: Risk Assessment
- Sub-Category
- Processes for receiving, analyzing, and responding to vulnerability disclosures are established
Related questions
- Does your organization implement vulnerability management tools to detect unpatched software and misconfigurations?
- Does your organization regularly conduct security architecture reviews to identify and remediate design and implementation weaknesses?
- Does your organization conduct security reviews, analysis, or testing of internally developed software to identify vulnerabilities in design, code, and default configurations?
- Has your organization conducted a comprehensive physical security assessment of all facilities housing critical computing assets within the past 12 months?
- Does your organization actively monitor cyber threat intelligence sources for information about new vulnerabilities in your products and services?
- Does your organization regularly conduct vulnerability assessments of business processes and procedures to identify potential cybersecurity weaknesses?