[non-validated] Security Policy Updates for Supplier Onboarding
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the security policy been reviewed and updated to address supplier security requirements following onboarding of new critical ICT providers, as required by Implementing Regulation (EU) 2024/2690 Annex 1.1.2?
Explanation
[non-validated] Has the entity documented evidence of timely security policy review and updates to address supplier security obligations following the onboarding of new critical ICT providers, consistent with EU Implementing Regulation 2024/2690 requirements?
Criterion and evidence
Management bodies must review/update security policies at least annually and when significant operational or risk changes occur per Annex 1.1.2 of Implementing Regulation (EU) 2024/2690. Evidence requires dated policy documentation showing explicit incorporation of supplier security controls post-onboarding of critical providers.
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Roles, Responsibilities, Authorities, and Security Policy. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What constitutes sufficient evidence of policy updates?
Documented policy revision dated after onboarding new critical ICT providers, explicitly referencing supplier security controls per Implementing Regulation (EU) 2024/2690 Annex 1.1.2. Board minutes alone are insufficient without formal policy documentation.
How is missing evidence handled?
Pending submission of dated policy records; absence of documentation despite onboarding triggers 'failed' assessment per evidence period requirements.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures (Version 1.0)
Mapping NIS2 Obligations with ECSF Role Profiles