Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Third parties and suppliers

How much assurance each supplier needs, what goes in the contract, and what to do when a supplier fails or is breached.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we decide how much assurance a supplier needs?
  2. How do we check a supplier's evidence rather than trusting their questionnaire answers?
  3. How do we decide which security clauses go into a contract?
  4. How do we exit a supplier without losing data or access control?
  5. How do we answer a customer's 300-question security questionnaire consistently?
  6. How do we decide who approves our answers to a customer's security questionnaire before we send them?
  7. How do we build and keep a library of security answers we can reuse?
  8. How do we decide whether to answer a questionnaire in full, point to a certificate, or decline?
  9. How do we write a customer-facing security overview that answers most questionnaires before they arrive?
  10. How do we log customer questionnaires so none are late or answered inconsistently?

When do we…

Triggers and timing: when something has to happen.

  1. When is a supplier supporting a "critical or important function" under DORA?
  2. When do we reassess a supplier we already use?
  3. When do we share a report, certificate or policy with a customer, and on what terms?

If…, then how…

Situations: something has happened, what now.

  1. If a supplier fails assessment but the business has already signed, then what?
  2. If a critical supplier is unavailable, can the service continue?
  3. If a supplier tells us they've had a breach, then how do we respond?
  4. If many of our critical services depend on one provider, then what do we do about it?
  5. If a supplier refuses our audit clause, then do we sign anyway?
  6. If a customer asks us to commit to a security term we cannot meet, then what do we do?
  7. If an answer we gave a customer turns out to be wrong, then what do we do?

Other categories