12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
The organization must consistently monitor, review, assess, and manage changes in supplier information security practices and service delivery, for upholding an agreed-upon level of information security and service delivery in accordance with established supplier agreements. Organization can e.g. review supplier service reports, hold progress meetings as per agreements, conduct audits on suppliers and sub-suppliers, and address issues identified in conjunction with independent auditor reports, if available.
The organization has defined the certifications or standards required of key partners. Commonly recognized standards related to cyber security include:
Certifications required from partners can make organization's own partner management more efficient and provide good evidence of a particular level of security or privacy of the partner.
The security arrangements required for critical online services, such as security features, service levels, and management requirements, are carefully defined in advance. Online services include e.g. connections, networks and network security solutions (e.g. firewalls).
The security features of online services can be e.g. the following:
A designated responsible person actively monitors the supplier's activities and services to ensure compliance with the security terms of the contracts and the proper management of security incidents.
Monitoring includes the following:
.png)
