Cybersecurity roles and responsibilities for suppliers and partners are established and coordinated

Implementation steps

1. 1

   Define security responsibilities for each vendor tier

   For each risk tier in your supplier inventory, write down what the supplier is responsible for (protecting data they process, notifying you of breaches, maintaining their own security controls) and what your organization is responsible for (limiting their access to least-privilege, monitoring their activity, reviewing their access periodically).

   confluencenotion
2. 2

   Establish incident notification and response coordination procedures

   For critical and high-risk suppliers, define the notification chain: if the supplier has a security incident affecting your data, who do they contact, how quickly, and through what channel? Define your organization's obligations as well. Capture these in a shared runbook or reference in the contract.

   confluencenotionjira
3. 3

   Name internal owners for critical supplier relationships

   Assign a named internal contact responsible for each critical or high-risk vendor relationship. This person is responsible for the periodic access review, the annual security assessment, and acting as the point of contact during incidents. The assignment should be documented and kept current.

Evidence required