________________________________________________________________________________________________________________________
along digital supply chains, through a practical methodology covering three interrelated steps. The first defines fundamental, crossindustry cybersecurity criteria for all suppliers with digital services. This aims to eliminate fundamental vulnerabilities from the outset and establish a common security baseline.
The second step involves suppliers performing risk assessments that evaluate the type, scope, and relevance of their interfaces with the company. Thirdly, depending on the criticality level, the defined requirements must be verified in different ways, for example, through self-disclosure, documented evidence or technical tests. Particularly for highly critical suppliers, on-site audits will play a key role.
In terms of content, the CoT approach is based on common international standards and can be integrated into existing procurement and compliance processes. To evaluate the implementation of the requirements on the supplier side, a conformity assessment in accordance with the relevant best practice is sometimes appropriate. Standard compliance provides suitable evidence that can be part of the contractual requirements that companies agree with their suppliers.
Checks and balances
Ensuring the supply chain is secure goes beyond a tick-box compliance exercise as it must be a model of continuous assurance. This should include appropriate due diligence that verifies a supplier’ s baseline cybersecurity maturity. They should be categorized based on their access to data or network. For example, a Tier 1 cloud provider requires deeper scrutiny than a Tier 3 office supplies vendor. It is also important to look for global certifications like ISO / IEC 27001, and demand evidence that the supplier follows a secure development lifecycle( SDLC).
In terms of the contractual relationship, trust must be built on clear, enforceable expectations. This can include the right to audit, so that a supplier’ s security controls can be inspected, or requesting a SOC 2 Type II report annually. The supply chain is also increasingly requiring mandatory breach notifications, with strict time windows for
20