The organisation should establish a formal agreement with a cybersecurity service provider. The agreement must require the provider to promptly notify the organisation of relevant threats and vulnerabilities and to advise on mitigation measures. This can be achieved through a service such as a Security Operations Center (SOC), a Managed Security Service Provider (MSSP), or a cyber threat intelligence feed that delivers timely alerts and actionable guidance.
Key contractual terms should include:
- Specific timeframes for threat and vulnerability notifications.
- The organisation's responsibility to provide the service with necessary system information.
- A process for ensuring alerts are received and handled by competent personnel.
If multiple companies enter into a joint contract, all subscribed companies must be listed in the contract. All participating companies must also retain a copy of the contract.
.svg)
