ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements & A.15.1.3 Information and Communication Technology Supply Chain

In this article explain ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements & A.15.1.3 Information and Communication Technology Supply Chain this controls.

A.15.1.2 Addressing Security Within Supplier Agreements

Control- Any suppliers that view, process, store, communicate or provide IT infrastructure component information for the organization should be defined and agreed with all applicable information security requirements.

Implementation Guidance- Supplier agreements should be defined and recorded so that the organization and the supplier do not misinterpret the obligations of the two parties to meet the applicable information security requirements.

To meet the information security requirements identified, the following points should be considered for inclusion in the agreements:

Description of information and methods of supply and access to the information to be provided or accessed;
classification of information by the classification scheme of an organization (see 8.2); mapping, where possible, between the classification scheme for that organization and that for the supplier’s scheme of classification;
legal and regulatory requirements, including data protection, copyright and intellectual property rights, and a description of how they will be complied with;
obligation to enforce an agreed control plan, including access management, performance analysis, monitoring, reporting and auditing for each contracting party;
Rules for acceptable use of information and, where necessary, unacceptable use;
either an explicit list of providers’ staff authorized to receive or access information or procedures, authorization conditions, and the removal, access or receipt by supplier personnel of the information of the organization;
Information security measures relating to a specific contract;
Requirements and procedures for incident management (in particular, communication and collaboration in the remediation of incidents);
Specific protocols and information protection criteria, such as for emergency response, authorization protocols, training and awareness criteria;
Sub-contracting related legislation, including the controls to be applied;
Applicable business partners, like the IT contact person;
screening needs of supplier workers, including test and notification responsibilities, if there is no completion of the test, or where the results give rise to doubts or concerns;
right to audit the contracting supplier processes and controls;
Failure to resolve and resolve conflicts;
The obligation of the supplier to submit an independent report on the efficiency of controls and the timely correction agreement for the relevant issues raised in the report periodically;
The obligations of the supplier to meet the security requirements of the organization.

Other Information- Conventions can differ significantly between different organizations and various types of providers. Therefore, all applicable security information threats and specifications should be taken into consideration. Other parties (e.g. sub-providers) can also include supplier arrangements.

In order to prevent any delay in arranging replacement products or services, the processes for continued processing where the service supplier is unable to offer its products or services need to be considered in this arrangement.

Also Read : ISO 27001 Annex : A.15 Supplier Relationships

A.15.1.3 Information and Communication Technology Supply Chain

Control- Supplier agreements will contain provisions to mitigate information security risks associated with IT Services and the product supply chain.

Implementation Guidance – For inclusion in supplier agreements on supply chain security, the following topics should be addressed:

Defining Information security standards to refer to the IT product or service creation, in addition to provider partnership information security generations;
Requiring suppliers to distribute security specifications across the supply chain for information and communication technologies services, if suppliers subcontract information and communication technology services provided to an organization;
Requiring suppliers to spread acceptable security practices through the accessibility chain for information and communication technology goods, if such goods include purchased items from other suppliers;
Implementation of a monitoring framework and appropriate validation methods that have complied with specified security criteria for information and communication technology products and services;
Implementation of a monitoring framework and appropriate validation methods that have complied with specified security criteria for information and communication technology products and services;
Ensuring that essential products can be tracked across the entire supply chain and their origin;
Getting assurance that the IT products supplied function as expected without any unexpected or unwelcome features;
define rules on information sharing and any problems and compromise between organizations and suppliers concerning the supply chain;
Implementation of detailed lifecycle and availability and related security risk protocols for the management of information and communications technologies. This involves handling the uncertainties that components are no longer available because suppliers no longer work or suppliers no longer supply such components because of the advancements made in technology.

Other Information- In addition to general practices on information protection, efficiency, project management, and system engineering, however, particular practices for information and communication technology are not replaced.

In order to understand the supply chain and all issues which have a significant impact on the goods and services being provided, companies are encouraged to collaborate with suppliers. Organizations will impact IT and IT chain practices by clarifying the problems that other suppliers can tackle in the information and communications technology supply chain through agreements with their suppliers.

Cloud computing services provide the information and communication technology supply chain as discussed here.

A well-known ISO 27001 Lead Auditor and ISO 27001 Lead Implementer certificate that mainly covers information security clauses and their implementation, i.e., controls which should be implemented by the organization to preserve the CIA triad, Confidentiality, Integrity, and Availability to maintain their critical, sensitive information in a secure manner. Infosavvy, an institute in Mumbai conducts training and certification for multiple domains in Information Security which includes IRCA CQI ISO 27001:2013 Lead Auditor (LA), ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). Infosavvy will help you to understand and recognize the full scope of your organization’s security checks to protect your organization’s activities and information equipment (assets) from attacks, and also to illustrate the controls for securing assets accessible to suppliers of the organization. We have trainers with extensive expertise and experience to ensure the efficient handling of the security of information. Consequently, the applicant will gain the necessary skills for the ISMS audit by using commonly agreed audit concepts, procedures and techniques.

Questions related to this topic

How do you maintain supplier relationships?
What are the types of supplier relationships?
WHAT IS ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements?
Why is it important to have a good relationship with suppliers?
Diffrence between ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements & A.15.1.3 Information and Communication Technology Supply Chain?

ISO 27001 Requirements

Clause 4.1 Understanding the organization and its context

Clause 4.2 Understanding the needs and expectations of interested parties

Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement

ISO 27001 Annex A Controls

About ISO 27002

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

https://g.co/kgs/ttqPpZ

Upcoming Training :- ISO27001 LA T. D.:-Coming soon.. ISO42001 LI T. D.:-16th,17th Nov 2024.

Leave a Comment Cancel Reply