THP-4 - Supply Chain Shared Responsibility Model
Control for defining and managing security responsibilities with vendors
Control Definition
Cybersecurity responsibilities between the organization and each vendor or third party must be clearly defined, classifying them by risk level and establishing the minimum security requirements and assessment frequency for each level. Contracts must include incident notification obligations, the right to audit, secure data deletion and liability for breaches, being reviewed with the security team before signing, and the necessary confidentiality agreements must be managed. The most critical vendors must be assessed and monitored periodically, remediation plans created when deviations occur, and all their access revoked immediately at the end of the relationship, verifying the secure deletion of shared information.
Requirements (How)
Requirement 1
We clearly define cybersecurity responsibilities between the organization and each vendor or third party.
Requirement 2
We classify vendors and third parties into risk levels: critical, high, medium and low.
Requirement 3
We define minimum security requirements for each risk level: mandatory certifications, enforceable policies and required technical controls.
Requirement 4
We define the compliance assessment frequency according to each vendor's risk level.
Requirement 5
We include in vendor contracts the obligation to report security incidents within a defined time.
Requirement 6
We include in contracts the right to audit or access to equivalent third-party assessments.
Requirement 7
We contractually require the secure deletion of organizational data at the end of the contract.
Requirement 8
We contractually establish the vendor's liability for security breaches it causes.
Requirement 9
We review vendor contracts with the security team before signing.
Requirement 10
We identify and apply processes and procedures to manage information security risks arising from the use of vendor products or services, defining and agreeing with each vendor the security requirements that apply according to the type of relationship.
Requirement 11
We immediately revoke all logical and physical access when the relationship with a vendor ends.
Requirement 12
We periodically assess critical and high-risk vendors to verify compliance with their certifications and security requirements.
Requirement 13
We produce compliance reports with remediation actions for deviations detected in assessments.
Requirement 14
We verify the secure deletion of organizational data from the vendor's systems at the end of the contract.
Requirement 15
We regularly monitor, review and manage changes in vendors' security practices and service delivery.
Requirement 16
We identify, document and regularly review confidentiality or non-disclosure agreements (NDAs) that reflect the organization's information protection needs, and make sure relevant staff and interested parties sign them.
Requirement 17
We supervise, monitor and review information system development activities when carried out by external third parties.