12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Organization should establish and follow processes to handle security risks tied to using products or services from suppliers. This ensures that a mutually agreed-upon level of information security is maintained in supplier relationships. It's beneficial to evaluate and select suppliers' products and services that have strong information security controls. Supplier controls must ensure the integrity of their information and processing, thereby safeguarding the organization's information security.
The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.
The organization has defined the certifications or standards required of key partners. Commonly recognized standards related to cyber security include:
Certifications required from partners can make organization's own partner management more efficient and provide good evidence of a particular level of security or privacy of the partner.
We define in advance the types of suppliers with whom cooperation requires access to confidential information or their processing areas, and through this e.g. demands data processing contracts. Such supplier types can be, for example, IT services, logistics, financial management and IT infrastructure components.
The processing agreement binds the actions of the data processor (such as the system vendor).
It can be important for us to ensure an important partner takes responsibility of e.g. access control (logging) and data recovery at the end of the contract according to our preferred policies.
.png)
