Supplier and third-party security policy

Define and apply processes to manage the security risk suppliers introduce.

What the ISO 27002 guidance expects the document to say: Requires processes and procedures to be defined and implemented for managing the information security risks that arise from using suppliers' products or services.

Establish and agree the relevant security requirements in each supplier contract.

What the ISO 27002 guidance expects the document to say: Requires the relevant information security requirements to be established and agreed with each supplier, scaled to the type of supplier relationship involved.

Extend security requirements down the ICT products and services supply chain.

What the ISO 27002 guidance expects the document to say: Requires processes and procedures to be defined and implemented to manage information security risk arising along the supply chain for ICT products and services.

Regularly monitor, review and manage change in supplier security practice and service delivery.

What the ISO 27002 guidance expects the document to say: Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regular basis, and requires change within them to be managed.

Agreements with suppliers shall specify whether PII is processed and the minimum technical and organizational measures the supplier must meet for the organization to meet its information security and PII protection obligations, shall clearly allocate responsibilities between the organization, its partners, suppliers and applicable third parties taking account of the type of PII processed, shall provide a mechanism for ensuring the organization supports and manages compliance with applicable legislation and regulation, and shall call for independently audited compliance acceptable to the customer. When the organization is a PII processor, its contracts with suppliers shall specify that PII is processed only on its instructions.

Establish a process ensuring that the organization's use of services, products or materials provided by suppliers aligns with its approach to the responsible development and use of AI systems.

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintain a Register of Information on all contractual arrangements for the use of ICT services, report it to competent authorities, assess risk before entering arrangements (including concentration and subcontracting), and adopt an ICT third-party risk strategy.

The Directive scopes this deliberately at direct suppliers and service providers, which makes the first artefact an inventory of who those parties are and which of them touch the network and information systems behind the service. From there the entity has to manage the security-related aspects of each relationship: what the supplier may access, what security obligations bind it, what happens on incident, and what happens at exit. Contract terms are the enforcement mechanism, so contracts that predate NIS2 and carry no security clauses are a live gap rather than a legacy inconvenience. Managed service providers and managed security service providers deserve separate attention because they hold privileged access into the estate, which makes their compromise the entity's incident.