Managing information security in the ICT supply chain
A.5.21
-
Last updated
Applicable
Catalog reference
Define and manage information security requirements specifically for the ICT supply chain (hardware, software, services) to address risks like tampered components and compromised vendors.
Narrative — how we satisfy this requirement
The hosting, backup, and monitoring suppliers are asked about their own subcontractors, and the checklist for the wider supply chain is still being extended.