Supply chain policy and supplier register

Catalog reference

Set a supply chain security policy for your relations with direct suppliers and service providers, including your own role in the chain, to reduce the identified risks. Set criteria for choosing and contracting suppliers: their cybersecurity and secure development practices, their ability to meet your requirements, the quality and resilience of their products and services, and your ability to diversify and avoid lock-in. Take into account the results of coordinated risk assessments of critical supply chains. Specify in contracts, where fitting through service level agreements, the cybersecurity requirements, awareness and training requirements, background checks of supplier staff, a duty to report incidents without delay, audit or audit report rights, a duty to fix vulnerabilities, subcontracting rules, and obligations at the end of the contract. Apply the same elements when you select suppliers and procure. Review the policy and watch, assess and act on changes in supplier practices on a schedule and after significant changes or incidents. Keep a register of direct suppliers and service providers with a contact point and the ICT products, services and processes each one supplies. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement