5.2Vendor and Supply Chain Management

No matter how thoroughly a company secures itself, outsourcing part of its operations means the management level of that vendor directly becomes the company's own risk. As supply chain attacks (attacks that use a vendor or software supplier as a stepping stone toward the real target) increase, how to design the process of selecting, contracting with, and auditing vendors is important practical work for an information security manager.

5.2.1Vendor selection and contractual security requirements

• At the vendor selection stage, evaluation must cover not just price and lead time but also what kind of information security management structure the vendor has--whether it holds ISMS certification, its history of past incidents, whether it conducts employee training, and so on. Because switching costs are high once problems surface after selection, due diligence before the contract is important.
• The contract must spell out security requirements explicitly, not just the scope of the outsourced work. Specifically, it should cover the scope of handling, storage location, and restriction of who has access for the entrusted information, the notification deadline in the event of an incident (for example, reporting within 24 hours of discovery), and data return and reliable erasure at contract termination. With a verbal agreement or vague clauses, it becomes hard to hold the vendor to a breach of contract even if its response is inadequate.