ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements & A.15.1.3 Information and Communication Technology Supply Chain

 

In this article explain ISO 27001 Annex : A.15.1.2 Addressing Security Within Supplier Agreements & A.15.1.3 Information and Communication Technology Supply Chain this controls.

A.15.1.2  Addressing Security Within Supplier Agreements

Control- Any suppliers that view, process, store, communicate or provide IT infrastructure component information for the organization should be defined and agreed with all applicable information security requirements.

Implementation Guidance- Supplier agreements should be defined and recorded so that the organization and the supplier do not misinterpret the obligations of the two parties to meet the applicable information security requirements.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

To meet the information security requirements identified, the following points should be considered for inclusion in the agreements:

1. Description of information and methods of supply and access to the information to be provided or accessed;
2. classification of information by the classification scheme of an organization (see 8.2); mapping, where possible, between the classification scheme for that organization and that for the supplier’s scheme of classification;
3. legal and regulatory requirements, including data protection, copyright and intellectual property rights, and a description of how they will be complied with;
4. obligation to enforce an agreed control plan, including access management, performance analysis, monitoring, reporting and auditing for each contracting party;
5. Rules for acceptable use of information and, where necessary, unacceptable use;
6. either an explicit list of providers’ staff authorized to receive or access information or procedures, authorization conditions, and the removal, access or receipt by supplier personnel of the information of the organization;
7. Information security measures relating to a specific contract;
8. Requirements and procedures for incident management (in particular, communication and collaboration in the remediation of incidents);
9. Specific protocols and information protection criteria, such as for emergency response, authorization protocols, training and awareness criteria;
10. Sub-contracting related legislation, including the controls to be applied;
11. Applicable business partners, like the IT contact person;
12. screening needs of supplier workers, including test and notification responsibilities, if there is no completion of the test, or where the results give rise to doubts or concerns;
13. right to audit the contracting supplier processes and controls;
14. Failure to resolve and resolve conflicts;
15. The obligation of the supplier to submit an independent report on the efficiency of controls and the timely correction agreement for the relevant issues raised in the report periodically;
16. The obligations of the supplier to meet the security requirements of the organization.

Other Information- Conventions can differ significantly between different organizations and various types of providers. Therefore, all applicable security information threats and specifications should be taken into consideration. Other parties (e.g. sub-providers) can also include supplier arrangements.

In order to prevent any delay in arranging replacement products or services, the processes for continued processing where the service supplier is unable to offer its products or services need to be considered in this arrangement.

Read More : https://info-savvy.com/iso-27001-annex-a-15-1-2-a-15-1-3/

-------------------------------------------------------------------------------------------------------------------------------------

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com