This document specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships. These requirements cover any procurement and supply of products and services, such as manufacturing or assembly, business process procurement, software and hardware components, knowledge process procurement, build-operate-transfer and cloud computing services. This document is applicable to all organizations, regardless of type, size and nature. To meet the requirements, it is expected that an organization has internally implemented a number of foundational processes or is actively planning to do so. These processes include, but are not limited to: business management, risk management, operational and human resources management, and information security.
Tämän julkaisun valmistelusta Suomessa vastaa SFS Suomen Standardit, puh. 09 149 9331.
Sisällysluettelo
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviated terms
5 Structure of this document
5.1 Clause 6
5.2 Clause 7
5.3 Relationship between Clause 6 and Clause 7
5.4 Annexes
6 Information security in supplier relationship management
6.1 Agreement processes
6.2 Organizational project-enabling processes
6.3 Technical management processes
6.4 Technical processes
7 Information security in a supplier relationship instance
7.1 Supplier relationship planning process
7.2 Supplier selection process
7.3 Supplier relationship agreement process
7.4 Supplier relationship management process
7.5 Supplier relationship termination process
Annex A Correspondence between ISO/IEC/IEEE 15288 and this document (informative)
Annex B Correspondence between ISO/IEC 27002 controls and this document (informative)
Annex C Objectives from Clauses 6 and 7 (informative)
ISO/IEC 27000 Information technology — Security techniques — Information security management systems — Overview and vocabulary
ISO/IEC 27036-1 Cybersecurity — Supplier relationships — Part 1: Overview and concepts
ISO/IEC 27000 Information technology — Security techniques — Information security management systems — Overview and vocabulary
ISO/IEC 27036-1 Cybersecurity — Supplier relationships — Part 1: Overview and concepts