Risk assessments in supplier agreements

Management should be involved in decisions regarding the use of private suppliers and outsourcing of a certain scope. The organisation should also ensure that all supplier agreements include specific information security and privacy requirements with private suppliers are based on risk assessments.

The risk assessment should include scenarios involving the supplier's authorized and possibly unauthorized access to health and personal data and other confidential information. These contractual requirements should clearly define the supplier's responsibilities for protecting data, reporting incidents, and allowing for security audits. All phases of supplier management, from procurement to the termination of the agreement, should be covered.