Supply chain security
Catalog reference
Have an adopted supply chain security policy; in it, set how you deal with your dependence on the products and services of suppliers and service providers that can affect the security of your network and information systems. Put the policy in writing and apply it demonstrably (art. 10(1)). Check whether your direct suppliers and direct service providers meet the security requirements you set under art. 7(5), and check this periodically (art. 10(2)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.
Narrative — how we satisfy this requirement
No narrative yet. Add one.