The organization should establish and document a formal process for conducting security assessments before initiating any procedure with an external actor (e.g., supplier, partner) that may gain access to security-classified information or participate in security-sensitive activities.
This process must include:
- A specific security protection assessment to identify the exact classified information or sensitive activities the external actor would be exposed to.
- A suitability assessment, based on the first assessment and other relevant circumstances, to evaluate whether the planned procedure is appropriate from a security perspective. This involves a risk-based judgement.
- A requirement that both assessments are formally documented.
If the suitability assessment concludes that the procedure is inappropriate from a security standpoint, the procedure must not be initiated.
