The security of your organization depends also from external parties.
IT, cloud, software providers, maintainers and partners can access data and systems or support essential processes. Supply chain security identifies these dependencies, applies proportionate controls, and prepares the organization to handle incidents that begin outside its perimeter.
Activities
- inventory and classification of third parties by criticality;
- mapping of relevant services, data, access and subcontractors;
- questionnaires and collection of evidence proportionate to the risk;
- evaluation of certifications, reports, tests and incident histories;
- contractual requirements on security, notification and cooperation;
- governance of remote access and support accounts;
- monitoring of variations, vulnerability and concentration of risk;
- exit strategy, portability and continuity in case of unavailability.
Supply chain incidents
Contacts, escalation times, required evidence and coordination methods are defined. Tabletop exercises can simulate a compromise of a cloud provider, a malicious software update, or prolonged unavailability of a critical service.
Output
- third party register and levels of criticality;
- minimum requirements for supplier categories;
- gaps and treatment plans;
- technical clauses to be coordinated with the legal office;
- indicators and revaluation calendar;
- continuity and exit plan for priority dependencies.