CSF-DOC-GVSC-1 Cybersecurity Supply Chain Policy

Implementation guidance

The header page and this section, up to and including Disclaimer, must be removed from the final version of the document. For more details on replacing the logo, yellow highlighted text and certain generic terms, see the Completion Instructions document.

Purpose of this document

This document describes how relationships with third party suppliers will be created and managed to ensure effective information security.

Areas of the framework addressed

The following areas of the Cybersecurity Framework are addressed by this document:

• Govern (GV)

o Cybersecurity Supply Chain Risk Management (GV.SC)

▪ GV.SC-01

▪ GV.SC-02

▪ GV.SC-03

▪ GV.SC-04

▪ GV.SC-08

▪ GV.SC-09

▪ GV.SC-10

General guidance

This is an important area which is increasing in focus with the growth of cloud computing. You need to make sure you understand what your suppliers are doing in terms of their information security.

You may have a large number of suppliers of varying types and the key to meeting the requirements of the standard in this area is to categorize them in the way described in this document. The highest degree of effort may then be used appropriately in managing the suppliers that are strategic to the organization rather than trying to treat them all equally.

Ensure you keep minutes of all supplier meetings and that supplier records are kept up to date with contact details and references to contractual documentation.

Review frequency

We would recommend that this document is reviewed annually.

Document fields

This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.

To update this field (and any others that may exist in this document):

1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name.

2. Press Ctrl A on the keyboard to select all text in the document (or use Select, Select All via the Editing header on the Home tab).

3. Press F9 on the keyboard to update all fields.

4. When prompted, choose the option to just update TOC page numbers.

If you wish to permanently convert the fields in this document to text, for instance, so that they are no longer updateable, you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible, go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check you have updated all fields correctly.

Further detail on the above procedure can be found in the toolkit Completion Instructions. This document also contains guidance on working with the toolkit documents with an Apple Mac, and in Google Docs/Sheets.

Copyright notice

Except for any specifically identified third-party works included, this document has been authored by CertiKit, and is ©CertiKit except as stated below. CertiKit is a company registered in England and Wales with company number 6432088.

Licence terms

This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence.

If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third-party copyright included in this document.

Disclaimer

Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use.

Therefore, please note that it is your responsibility to ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country.

You should take all reasonable and proper legal and other professional advice before using this document.

CertiKit makes no claims, promises, or guarantees about the accuracy, completeness or adequacy of our document templates; assumes no duty of care to any person with respect its document templates or their contents; and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Cybersecurity Supply Chain Policy

Revision history

1 Introduction

[Organization Name] and its core business exists in a wider economic environment in which effective relationships with suppliers are critical to its continued success. However, recent information security breaches have shown that sometimes a third-party supplier can represent a significant weakness in the defences of our information assets.

It is very important therefore that our relationships with suppliers are based on a clear understanding of our expectations and requirements in the area of information security. These requirements must be documented and agreed in a way that leaves no doubt about the importance we place on the maintenance of effective controls to reduce risk.

It is up to [Organization Name] to demonstrate to our stakeholders that the choices we make regarding suppliers are done with due diligence and that the ongoing monitoring and review of the service supplied is performed in an effective way.

The purpose of this document is to set out the organization’s information security policy in the area of cybersecurity supply chain

The following documents are relevant to this policy:

• Supplier Information Security Agreement

• Supplier Information Security Evaluation Process

• Supplier Due Diligence Assessment Procedure

• Cloud Services Policy

2 Cybersecurity supply chain policy

2.1 General provisions

In general, information security requirements will vary according to the type of contractual relationship that exists with each supplier and the goods or services delivered. However, the following will generally apply.

• The information security requirements and controls must be formally documented in a contractual agreement which may be part of, or an addendum to, the main commercial contract

• Separate Non-Disclosure Agreements must be used where a more specific level of control over confidentiality is required

• Appropriate due diligence must be exercised in the selection and approval of new suppliers before contracts are agreed

• The information security provisions in place at existing suppliers (where due diligence was not undertaken as part of initial selection) must be clearly understood and improved where necessary

• Remote access by suppliers must be via approved methods that comply with our information security policies

• Access to [Organization Name] information must be limited where possible according to clear business need

• Basic information security principles such as least privilege, segregation of duties and defence in depth must be applied

• The supplier will be expected to exercise adequate control over the information security policies and procedures used within sub-contractors who play a part in the supply chain of delivery of goods or services to [Organization Name]

• [Organization Name] will have the right to audit the information security practices of the supplier and, where appropriate, sub-contractors

• Incident management and contingency arrangements must be put in place based on the results of a risk assessment

• Awareness training will be carried out by both parties to the agreement, based on the defined processes and procedures

The selection of required controls must be based upon a comprehensive risk assessment considering information security requirements, the product or service to be supplied, its criticality to the organization and the capabilities of the supplier.

2.2 Cloud services

Cloud service providers (CSPs) must be clearly recognized as such so that the risks associated with the CSP’s access to and management of [Organization Name] cloud data may be managed appropriately.

When acting as a CSP, [Organization Name] will clearly set out the relevant information security measures it will implement as part of the agreement. [Organization Name] will also ensure that information security objectives are set for third parties who provide components of the cloud service to customers and that they carry out adequate risk assessment in order to achieve an acceptable level of security.

2.3 Due diligence

Before contracting with a supplier, it is incumbent upon [Organization Name] to exercise due diligence in reaching as full an understanding as possible of the information security approach and controls the company has in place. It is important that the documented Supplier Due Diligence Assessment Procedure is followed so that all the required information is collected, and an informed assessment can be made.

This is particularly important where cloud computing services are involved, as legal considerations regarding the location and storage of personal data must be considered.

2.4 Addressing security within supplier agreements

Once a potential supplier has been positively assessed with due diligence the information security requirements of [Organization Name] must be reflected within the written contractual agreement entered into. This agreement must consider the classification of any information that is to be processed by the supplier (including any required mapping between [Organization Name] classifications and those in use within the supplier), legal and regulatory requirements and any additional information security controls that are required.

For cloud service contracts, information security roles and responsibilities must be clearly defined in areas such as backups, incident management, vulnerability assessment and cryptographic controls.

A template [Organization Name] Supplier Information Security Agreement may be used as a starting point.

Appropriate legal advice must be obtained to ensure that contractual documentation is valid within the country or countries in which it is to be applied.

2.5 Evaluation of existing suppliers

For those suppliers that were not subject to an information security due diligence assessment prior to an agreement being made, an evaluation process must be undertaken in order to identify any required improvements. For details of this process see Supplier Information Security Evaluation Process.

2.6 Monitoring and review of supplier services

In order to focus resources on the areas of greatest need, suppliers will be categorized based on an assessment of their value and criticality to the organization.

Each supplier will be placed into one of the following four categories:

1. Commodity

2. Operational

3. Tactical

4. Strategic

The recommended frequency of supplier review meetings between [Organization Name] and each supplier will be determined by the supplier’s category according to the following table.

Commodity

Operational

None

On contract renewal

Tactical Annually

Strategic

Monthly/Quarterly

Each supplier will have a designated contract manager within [Organization Name] who is responsible for arranging, chairing and documenting the meetings.

The performance of strategic suppliers will be monitored on a regular basis in line with the recommended meeting frequency. This will take the form of a combination of supplierprovided reports against the contract and internally produced reports.

Where possible, a frequent cross-check will be made between the supplier reports and those created internally in order to make sure the two present a consistent picture of supplier performance. Both sets of reports will be reviewed at supplier meetings and any required actions agreed.

Table 1: Meeting frequencies by supplier category

2.7 Managing changes to supplier services

2.7.1 Changes within contract

Changes to services provided by suppliers will be subject to the [Organization Name] change management process. This process includes the requirement to assess any information security implications of changes so that the effectiveness of controls is maintained.

2.7.2 Contractual Disputes

In the event of a contractual dispute, the following initial guidelines must be followed:

• The Chief Financial Officer must be informed that a dispute exists

• The CFO will then decide on next steps, based on an assessment of the dispute

• Where applicable, legal advice should be obtained via the CFO

• All correspondence with the supplier in dispute must be in writing and with the approval of the CFO

• An assessment of the risk to the organization should be carried out prior to escalating any dispute, and contingency plans put in place

At all times the degree of risk to the business must be managed and if possible minimized

2.7.3 End of contract

The following process will be followed for scheduled end of contract, early end of contract or transfer of contract to another party:

• The end of contract will be requested in writing within the agreed terms

• Transfer to another party shall be planned as a project and appropriate change control procedures followed

• An assessment of the risk to the organization should be carried out prior to ending or transferring the contract, and contingency plans put in place

• Any budgetary implications shall be incorporated into the financial model

The various aspects of ending a contract must be carefully considered at initial contract negotiation time.