#iso27002/2022/EN
[[ISO_27002_PE 5.21 Managing information security in the ICT supply chain]]

## 5.21 Managing information security in the ICT supply chain

**Control**
Processes and procedures should be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.

**Purpose**
To maintain an agreed level of information security in supplier relationships.

**Guidance**

The following topics should be considered to address information security within ICT supply chain security in addition to the general information security requirements for supplier relationships:

a\) defining information security requirements to apply to ICT product or service acquisition;

b\) requiring that ICT services suppliers propagate the organization’s security requirements throughout the supply chain if they sub-contract for parts of the ICT service provided to the organization;

c\) requiring that ICT products suppliers propagate appropriate security practices throughout the supply chain if these products include components purchased or acquired from other suppliers or other entities (e.g. sub-contracted software developers and hardware component providers);

d\) requesting that ICT products suppliers provide information describing the software components used in products;

e\) requesting that ICT products suppliers provide information describing the implemented security functions of their product and the configuration required for its secure operation;

f\) implementing a monitoring process and acceptable methods for validating that delivered ICT products and services comply with stated security requirements. Examples of such supplier review methods can include penetration testing and proof or validation of third-party attestations for the supplier’s information security operations;

g\) implementing a process for identifying and documenting product or service components that are critical for maintaining functionality and therefore require increased attention, scrutiny and further follow up required when built outside of the organization especially if the supplier outsources aspects of product or service components to other suppliers;

h\) obtaining assurance that critical components and their origin can be traced throughout the supply chain;

i\) obtaining assurance that the delivered ICT products are functioning as expected without any unexpected or unwanted features;

j\) implementing processes to ensure that components from suppliers are genuine and unaltered from their specification. Example measures include anti-tamper labels, cryptographic hash verifications or digital signatures. Monitoring for out of specification performance can be an indicator of tampering or counterfeits. Prevention and detection of tampering should be implemented during multiple stages in the system development life cycle, including design, development, integration, operations and maintenance;

k\) obtaining assurance that ICT products achieve required security levels, for example, through formal certification or an evaluation scheme such as the Common Criteria Recognition Arrangement;

l\) defining rules for sharing of information regarding the supply chain and any potential issues and compromises among the organization and suppliers;

m\) implementing specific processes for managing ICT component life cycle and availability and associated security risks. This includes managing the risks of components no longer being available due to suppliers no longer being in business or suppliers no longer providing these components due to technology advancements. Identification of an alternative supplier and the process to transfer software and competence to the alternative supplier should be considered.

**Other information**

The specific ICT supply chain risk management practices are built on top of general information security, quality, project management and system engineering practices but do not replace them.

Organizations are advised to work with suppliers to understand the ICT supply chain and any matters that have an important effect on the products and services being provided. The organization can influence ICT supply chain information security practices by making clear in agreements with their suppliers the matters that should be addressed by other suppliers in the ICT supply chain.

ICT should be acquired from reputable sources. The reliability of software and hardware is a matter of quality control. While it is generally not possible for an organization to inspect the quality control systems of its vendors, it can make reliable judgments based on the reputation of the vendor.

ICT supply chain as addressed here includes cloud services.

Examples of ICT supply chains are:

a\) cloud services provisioning, where the cloud service provider relies on the software developers, telecommunication service providers, hardware providers;

b\) IoT, where the service involves the device manufacturers, the cloud service providers (e.g. the IoT platform operators), the developers for mobile and web applications, the vendor of software libraries;

c\) hosting services, where the provider relies on external service desks including first, second and third support levels.