Definition of responsibilities with service providers

The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.

A designated responsible person actively monitors the supplier's activities and services to ensure compliance with the security terms of the contracts and the proper management of security incidents.

Monitoring includes the following:

• monitoring the promised service level
• reviewing supplier reports and arranging follow-up meetings
• regular organization of independent audits
• follow-up of problems identified in audits
• more detailed investigation of security incidents and review of related documentation
• review of the supplier's future plans (related to maintaining the service level)

The organization must communicate to suppliers their roles and responsibilities in supply chain security. It must also be ensured that suppliers understand their security guidelines and any other security responsibilities under the agreements.

Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.

For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:

• publicly available guidelines (e.g. templates from suppliers and independent security organizations)
• the level of protection required for different assets
• fulfilling related information security requirements
• feasibility and applicability of the configurations to the organization's operations

Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.

The following points should be taken into account when defining standard templates:

• the number of root-level rights is minimized
• unnecessary access rights are disabled
• unnecessary functions and services are deactivated
• access to powerful utilities and important settings is strictly controlled
• the clocks are synchronized
• the supplier's default passwords are changed immediately and the security-related settings are checked
• timeout functions are used if necessary (e.g. automatic logout)
• license requirements are met

Current configurations of devices, data systems and networks are documented and a log is maintained of configuration changes.

Changes to configurations must be controlled and go through the change management procedure. Only authorized personnel are allowed to make changes to the configurations.

Configuration information may include e.g.:

• property owner and contact point information
• date of last configuration change
• configuration model version
• connections to other assets

The organization must identify critical IT partners. A critical partner (internal or external) refers to a partner without whom the operation is interrupted.

Configurations should be monitored with comprehensive system management tools (e.g. maintenance utilities, remote support, enterprise management tools, backup and recovery software) and reviewed regularly to assess settings, password strengths, and operations performed. Actual configurations can be compared to defined target models. Any discrepancies must be dealt with either automatically or by manual processing.

Any unauthorized changes must be corrected and cause investigated and reported.