THP-3 - Supply Chain Inventory
Control for the identification, classification and management of vendors and third parties
Control Definition
Processes must be defined to manage the security risks associated with the supply chain, ensuring that external products and services affecting the organization are properly controlled. A complete, up-to-date record of all vendors, partners and third parties with access to systems, data or infrastructure must be maintained, classifying them by criticality and access level, and security due diligence must be performed before onboarding, verifying their certifications. This inventory must be reviewed periodically, staff backgrounds verified according to their access level, and the return of organizational assets ensured at the end of any relationship.
Requirements
Requirement 1
We maintain a complete, up-to-date record of all vendors, partners and third parties with access to the organization's systems, data or infrastructure.
Requirement 2
We include software vendors, cloud services, security services, integrators and contractors in the inventory.
Requirement 3
For each vendor we record: name, type of service, access level, data shared, criticality, internal owner, current certifications and date of last assessment.
Requirement 4
We perform security due diligence as a mandatory part of the onboarding process for new vendors.
Requirement 5
We assess new vendors through defined questionnaires and verify their relevant certifications.
Requirement 6
We classify vendors by criticality and access level to determine the depth of due diligence required.
Requirement 7
We make sure external processes, products or services that affect the information security management system are properly controlled.
Requirement 8
We make sure employees and third parties return all organizational assets in their possession when they change role or end their relationship with the organization.
Requirement 9
We define and apply processes and procedures to manage the security risks associated with the supply chain of technology products and services.
Requirement 10
We verify the background of all candidates before hiring them, complying with applicable laws and regulations and in proportion to the level of access to information they will have.
Requirement 11
We review the vendor inventory at a defined frequency to identify those that no longer meet security requirements.
Requirement 12
We verify staff backgrounds on an ongoing basis, complying with applicable laws and regulations and according to the identified risks.