Objective: Particularly in the case of external IT services that can be used at relatively low cost or free of charge, there is an increased risk that procurement and commissioning will be carried out without appropriate consideration of the information security requirements and that security therefore is not ensured.
Requirements (must): External IT services are not used without explicit assessment and implementation of the information security requirements:
- A risk assessment of the external IT services is available,
- Legal, regulatory, and contractual requirements are considered.
The external IT services have been harmonized with the protection need of the processed information assets.
Requirements (should): Requirements regarding the procurement, commissioning and release associated with the use of external IT services are determined and fulfilled.
A procedure for release in consideration of the protection need is established.
External IT services and their approval are documented.
It is verified at regular intervals that only approved external IT services are used.
The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.
External IT services are not used without explicit assessment and implementation of the information security requirements:
The external IT service must meet the needed requirements for data they will handle.
The organisation must review at regular intervals that only approved external IT services are used.
The organization has defined the certifications or standards required of key partners. Commonly recognized standards related to cyber security include:
Certifications required from partners can make organization's own partner management more efficient and provide good evidence of a particular level of security or privacy of the partner.
Minimum security requirements have been set for partner companies handling our confidential information and these have been included in supplier agreements. Requirements vary depending on how critical information the partner handles.
It makes sense for requirements to consist of rules and practices that are followed in your own organization. You can divide the requirement levels into low, medium and high risk suppliers.
The organization has defined the certifications or standards required of key partners. Commonly recognized standards related to cyber security include:
Certifications required from partners can make organization's own partner management more efficient and provide good evidence of a particular level of security or privacy of the partner.
The organization shall identify
Data system providers and personal data processors are treated through separate tasks.
The organization must take into account the risks caused by partners when managing information security risks. If necessary, separate theme-specific risk assessments can be made for critical partners.
.png)
