12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Classify service providers. Classification consideration may include one or more characteristics, such
as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and
mitigated risk. Update and review classifications annually, or when significant enterprise changes
occur that could impact this Safeguard.
The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.
The organization establishes criteria for classifying service providers based on factors such as data sensitivity, volume, availability, regulatory compliance, and risk levels, regularly updating these classifications to manage potential impacts on the organization effectively.
Minimum security requirements have been set for partner companies handling our confidential information and these have been included in supplier agreements. Requirements vary depending on how critical information the partner handles.
It makes sense for requirements to consist of rules and practices that are followed in your own organization. You can divide the requirement levels into low, medium and high risk suppliers.
We define in advance the types of suppliers with whom cooperation requires access to confidential information or their processing areas, and through this e.g. demands data processing contracts. Such supplier types can be, for example, IT services, logistics, financial management and IT infrastructure components.
.png)
