Monitoring suppliers' compliance with security requirements

Organisation must define

• stakeholders relevant to the information security management system
• information security requirements set by these stakeholders

Customer groups or individual significant customers that are important to the organization's operations are usually one of the most important stakeholders, also from the point of view of information security. Other stakeholders are treated through other tasks.

A supplier agreement will be drawn up with all partners directly or indirectly involved in the processing of data. The aim is to ensure that there is no misunderstanding between the organization and the supplier of parties' obligations regarding to complying with security requirements.

The organization shall include in the supplier agreement, as appropriate:

• the data used by the supplier (and possible data classification) and staff receiving access to data
• rules on the acceptable use of data
• confidentiality requirements for data processing staff
• parties responsibilities in meeting regulatory requirements
• parties' concrete responsibilities in relation to data security (e.g. access control, monitoring)
• reporting and correcting incidents
• requirements for the use of subcontractors
• allowing auditing supplier processes and controls related to the contract (and committing to correcting non-conformities)
• a commitment to return or destroy data at the end of the contract
• the supplier's responsibility to comply with organization's security guidelines

The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.

The organization has included the service level requirements necessary for the continuity of operations as part of procurement requirements and contracts.

In particular, it is important to agree on the parts of the data processing environment that are necessary for critical functions (e.g. the information systems and partners that support these functions) in a way that guarantees sufficient availability of services. Contracts can include requirements, e.g. general service level (SLA) and recovery from problem situations (RPO, RTO).

The organization must communicate to suppliers their roles and responsibilities in supply chain security. It must also be ensured that suppliers understand their security guidelines and any other security responsibilities under the agreements.

When involving subprocessors in processing personal data related to offered cloud services, the organization ensures that contracts clearly specify the minimum technical and organizational security measures required from subprocessors.

The organization lists the relevant government actors with whom it is important to actively contact and, if necessary, get in touch quickly. These authorities include national law enforcement and supervisory authorities.

A clear contact person should be defined for the relevant authorities to act as a contact point for the organization.

The organization should actively maintain contacts with cloud-related stakeholders and other relevant parties related to the organization's operations.

The organization shall identify

• the stakeholders relevant to the security management system
• the security requirements set by these stakeholders

Data system providers and personal data processors are treated through separate tasks.

A responsible person has been appointed for the provider companies, who monitors the provider's activities, communications and compliance with the contract.

Responsible person must have sufficient skills to analyze cyber security requirements depending on the criticality of the provider. Responsible person also ensures that the provider appoints an own responsible person to ensure compliance with the contract and facilitate cooperation.

A designated responsible person actively monitors the supplier's activities and services to ensure compliance with the security terms of the contracts and the proper management of security incidents.

Monitoring includes the following:

• monitoring the promised service level
• reviewing supplier reports and arranging follow-up meetings
• regular organization of independent audits
• follow-up of problems identified in audits
• more detailed investigation of security incidents and review of related documentation
• review of the supplier's future plans (related to maintaining the service level)

Define participation conditions in information-sharing arrangements and notify competent authorities of participation.

1. Define participation conditions in information-sharing arrangements, including the involvement of public authorities and their potential roles, participation of ICT third-party service providers, and operational details such as the use of dedicated IT platforms.
2. Notify competent authorities of participation in information-sharing arrangements, upon validation of membership, or, as applicable, of cessation of membership once it takes effect.

When assessing risks related to ICT services supporting critical functions, financial entities should consider:

• Whether contracting with a non-substitutable ICT service provider is involved.
• The implications of multiple contracts with the same or closely connected ICT service providers.
• Evaluating alternative solutions like using different service providers, aligning with business needs and digital resilience strategy.

Regarding subcontracting:

• Financial entities should assess benefits and risks of subcontracting, especially when subcontractors are based in third countries.
• Consideration of insolvency law provisions in case of the service provider's bankruptcy and constraints on data recovery.
• Compliance with Union data protection rules and law enforcement in third countries.
• Assessment of potential impacts of complex subcontracting chains on monitoring and supervisory abilities.

The contractual agreements for critical ICT services should include:

• Detailed service level descriptions with clear performance targets for effective monitoring and corrective actions.
• Notice periods and reporting obligations for any developments affecting service provision.
• Contingency plans, security measures, and policies for business continuity and regulatory compliance.
• Participation in the financial entity's TLPT.
• Rights to monitor performance through access, inspection, and audits, with provisions for alternative assurance levels.
• Cooperation during inspections and audits by competent authorities or appointed parties.
• Details on scope, procedures, and frequency of inspections and audits.
• Exit strategies, including transition periods for seamless migration or restructuring.
• Option for microenterprises to delegate monitoring rights to an independent third party appointed by the service provider.

The organization must obtain confidentiality commitments:

• from vendors
• business partners

Furthermore, privacy commitments must be obtained:

• in addition to obtaining commitments from sellers
• business partners

the organization must assess:

• compliance with data protection commitments of sellers and business partners
• compliance with confidentiality obligations of sellers and business partners

The organization shall actively maintain contacts with stakeholders relevant to the organization's operations and other relevant actors related to the organization's operations and security.

The goal is especially to:

• increase knowledge of best practices and keep up to date with relevant security information
• ensure that organisation's understanding of the security environment is up-to-date and complete

Supplier and partner agreements should include requirements that directly limit changes affecting customer environments.

Changes should be explicitly approved and included in the scope of service level agreements.

The responsible person monitors significant changes in the supplier's operations that may affect the supplier relationship and service level, and thus require other measures. The following aspects are taken into account:

• direct changes to supplier agreements
• service content improvements, new technologies or the development of new services
• significant changes in operating methods (either related to cyber security or other activities)
• changes in the physical location of the data
• changes in the supply chain / subcontracting process

Data processing agreements bind the actions of a personal data processing partner.

It can be important for us to require an important partner to take care of e.g. ensuring the confidentiality requirements for its personnel and restricting the use of other processors of personal data in connection with our data.