Related: [Vendor security MoC](../🎇%20Sparks/Vendor%20security%20MoC.md)

ESCROW
BOM

From [ISO_27002_2022_5.19_PE Information security in supplier relationships](../../../iso27DIY-gis/reference/Paraphrased/ISO27002-2022-EN/ISO_27002_2022_5.19_PE%20Information%20security%20in%20supplier%20relationships.md) (selection)
- criteria and procedures for vendor selection, taking the sensitivity of products, services and the information they'll be working with into account. 
- checking that the vendor has implemented adequate controls for information security, personnel security and physical security
- processes and procedures the vendor needs to implement for implementing and terminating the product/service in your organization
- continuity measures in case the vendor is no longer willing or able to supply its products or services
- return of assets
- the ownership of what has been developed during the relationship
- continuation of non-disclosure/confidentiallity agreements

From [ISO_27002_2022_5.21_PE Managing information security in the ICT supply chain](../../../iso27DIY-gis/reference/Paraphrased/ISO27002-2022-EN/ISO_27002_2022_5.21_PE%20Managing%20information%20security%20in%20the%20ICT%20supply%20chain.md) (selection)

- require that suppliers demand the same level of security for sub-contractors and product or component suppliers, as you demand of them
- request a 'bill of materials' for third party software components they use
- description of security functions in the product, and directions for the correct configuration thereof
- rules for communicating issues and compromises in the supply chain
- component lifecycle management, incl. availabilty risks and end-of-service
- alternative suppliers, software and knowledge transfers



