Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.

The organization shall identify

• the stakeholders relevant to the security management system
• the security requirements set by these stakeholders

Data system providers and personal data processors are treated through separate tasks.

The organization agrees upon and implements a common information security risk management procedure and processes with stakeholders.

The organization should seek to integrate third-party risk management into its overall information security risk management. This should involve:

• Evaluating interdependencies
• Assessing risks related to contracts provided by third parties
• Addressing the scalability of risk management based on the organization's size and needs