{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/supplier-management","url":{"en":"https://atlas.maintz.dev/en/terms/security/supplier-management/","da":"https://atlas.maintz.dev/da/terms/security/supplier-management/"},"term":{"en":"Supplier management","da":"Leverandørstyring"},"aka":{"en":["supply-chain security","third-party risk management","vendor management"],"da":["sikkerhed i forsyningskæden","tredjepartsstyring"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"Making sure outside partners who handle your data or systems meet your security demands.","da":"At sikre, at eksterne partnere, der håndterer ens data eller systemer, lever op til ens sikkerhedskrav."},"body":{"formal":{"en":"The ongoing process of selecting, contracting, monitoring and exiting suppliers - as required by NIS2 Article 21(2)(d) and ISO 27002 controls 5.19-5.22 - so that the risks they bring are known and kept within the organisation's accepted limits.","da":"Den løbende proces med at vælge, indgå aftaler med, følge op på og afslutte samarbejdet med leverandører - som krævet i NIS2 artikel 21, stk. 2, litra d, og ISO 27002 kontrol 5.19-5.22 - så de risici, de bringer med sig, er kendte og holdes inden for organisationens accepterede grænser."},"plain":{"en":"You lock your own front door, but you also check that the cleaning company holding a spare key looks after it properly.","da":"Du låser din egen hoveddør, men tjekker også, at rengøringsfirmaet, der har en ekstra nøgle, passer ordentligt på den."},"inPractice":{"en":"Before a Danish hospital lets the maker of its infusion pumps log in remotely for maintenance, the procurement officer asks for the supplier's security report, writes breach-notice terms into the contract and books a yearly review.","da":"Før et dansk hospital lader producenten af dets medicinske pumper logge ind udefra for at vedligeholde dem, beder indkøberen om leverandørens sikkerhedsrapport, skriver krav om besked ved brud ind i kontrakten og aftaler en gennemgang hvert år."},"whyItMatters":{"en":"Attackers often go through the weakest supplier to reach many customers at once, so an organisation's security is only as strong as that of the partners it lets in.","da":"Angribere går ofte gennem den svageste leverandør for at ramme mange kunder på én gang, så en organisations sikkerhed er kun så stærk som de samarbejdspartnere, den lukker ind."}},"deepDive":{"en":"ISO/IEC 27002:2022 splits the topic into five controls: 5.19 (information security in supplier relationships: define processes to manage the risks of using suppliers' products and services), 5.20 (addressing information security in supplier agreements), 5.21 (managing information security in the ICT supply chain, including sub-suppliers and components), 5.22 (monitoring, review and change management of supplier services) and 5.23 (information security for use of cloud services, new in 2022, covering acquisition, use, management and exit). The guidance assumes a lifecycle: classify suppliers by criticality and data access, set requirements before contracting, embed them in the agreement, monitor during the relationship and manage termination, including return or deletion of data and revocation of access.\n\nLegal drivers stack on top. NIS2 Article 21(2)(d) requires supply chain security, including security-related aspects of relationships with direct suppliers and service providers, and Article 21(3) requires entities to take into account each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, and its secure development procedures; Article 22 adds coordinated EU-level risk assessments of critical supply chains. The GDPR requires processors to provide sufficient guarantees (Article 28(1)), a written data processing agreement (databehandleraftale) with the content listed in Article 28(3), and prior authorisation for sub-processors (Article 28(2)). DORA goes furthest for financial entities, with a register of information on all ICT third-party arrangements and mandatory contractual provisions. NIST CSF 2.0 places the topic in the Govern function as GV.SC.\n\nAssurance comes in tiers: supplier questionnaires (self-assessments such as the CSA CAIQ or a customer's own), certificates (ISO/IEC 27001, checking that the scope actually covers the purchased service), independent assurance reports (ISAE 3402 or SOC 2 Type II covering a period of operation; in Denmark ISAE 3000 reports are common for data processors), and the customer's own audits. Technical signals such as external attack-surface ratings and SBOMs complement but do not replace them.\n\nCommon failure modes: tiering done once at onboarding and never revisited; contracts without breach-notification deadlines, audit rights or exit clauses; blind spots for fourth parties, such as a SaaS provider's own hosting and subcontractors; privileged remote access for suppliers without MFA, session logging or time limits; and trusting a certificate whose scope excludes the service actually used. Incidents such as the SolarWinds Orion compromise in 2020 and the MOVEit Transfer exploitation in 2023 showed how a single supplier can become the entry point to thousands of customers, which is why supplier management overlaps with software supply chain security rather than being a procurement formality.","da":"ISO/IEC 27002:2022 deler emnet i fem kontroller: 5.19 (informationssikkerhed i leverandørforhold: fastlæg processer til at styre risiciene ved at bruge leverandørers produkter og tjenester), 5.20 (informationssikkerhed i leverandøraftaler), 5.21 (styring af informationssikkerhed i IKT-forsyningskæden, herunder underleverandører og komponenter), 5.22 (overvågning, gennemgang og ændringsstyring af leverandørers ydelser) og 5.23 (informationssikkerhed ved brug af cloudtjenester, ny i 2022, der dækker anskaffelse, brug, styring og exit). Vejledningen forudsætter en livscyklus: klassificér leverandørerne efter kritikalitet og adgang til data, fastsæt krav før kontraktindgåelse, skriv dem ind i aftalen, følg op under samarbejdet og styr afslutningen, herunder tilbagelevering eller sletning af data og fjernelse af adgange.\n\nLovkravene lægger sig ovenpå. NIS2 artikel 21, stk. 2, litra d, kræver sikkerhed i forsyningskæden, herunder de sikkerhedsrelaterede aspekter af forholdet til direkte leverandører og tjenesteudbydere, og artikel 21, stk. 3, kræver, at enheden tager højde for hver direkte leverandørs særlige sårbarheder, den samlede kvalitet af dens produkter og cybersikkerhedspraksis og dens procedurer for sikker udvikling; artikel 22 tilføjer koordinerede risikovurderinger af kritiske forsyningskæder på EU-niveau. GDPR kræver, at databehandlere stiller tilstrækkelige garantier (artikel 28, stk. 1), en skriftlig databehandleraftale med det indhold, der står i artikel 28, stk. 3, og forudgående godkendelse af underdatabehandlere (artikel 28, stk. 2). DORA går længst for finansielle enheder med et informationsregister over alle aftaler med IKT-tredjepartsudbydere og obligatoriske kontraktbestemmelser. NIST CSF 2.0 placerer emnet i Govern-funktionen som GV.SC.\n\nSikkerheden for, at leverandøren lever op til kravene, kommer i niveauer: leverandørspørgeskemaer (selvevalueringer som CSA's CAIQ eller kundens egne), certifikater (ISO/IEC 27001, hvor man skal tjekke, at omfanget faktisk dækker den købte ydelse), uafhængige revisorerklæringer (ISAE 3402 eller SOC 2 type 2, der dækker en driftsperiode; i Danmark er ISAE 3000-erklæringer udbredte for databehandlere) og kundens egne audits. Tekniske signaler som eksterne vurderinger af angrebsfladen og SBOM'er supplerer, men erstatter dem ikke.\n\nTypiske fejl: leverandørerne klassificeres én gang ved onboarding og aldrig igen; kontrakter mangler frister for underretning ved brud, auditret eller exitklausuler; blinde vinkler for fjerdeparter, fx en SaaS-udbyders egen hosting og underleverandører; privilegeret fjernadgang for leverandører uden MFA, sessionslogning eller tidsbegrænsning; og tillid til et certifikat, hvis omfang ikke omfatter den ydelse, der faktisk bruges. Hændelser som kompromitteringen af SolarWinds Orion i 2020 og udnyttelsen af MOVEit Transfer i 2023 viste, hvordan én leverandør kan blive indgangen til tusindvis af kunder, og derfor overlapper leverandørstyring med sikkerhed i softwareforsyningskæden i stedet for at være en indkøbsformalitet."},"howTo":{"steps":{"en":["Build a register of every supplier with access to your data, systems or premises, including cloud and SaaS services, and name an internal owner for each relationship.","Classify the suppliers by criticality and data access, so the most important ones get the closest scrutiny.","Set security requirements before you buy, and ask critical suppliers for evidence such as an ISO/IEC 27001 certificate whose scope covers the service, an ISAE 3402 or ISAE 3000 report, or a SOC 2 Type II report.","Write the requirements into the contract, including incident notification deadlines, audit rights, rules for subcontractors, a data processing agreement where personal data is involved, and exit terms.","Give suppliers remote access only through named accounts with MFA, logging and time limits.","Follow up on critical suppliers at least once a year by reviewing new assurance reports, incidents and changes, and reassess their classification.","Include key suppliers in your incident response and continuity plans and exercises, with contact details and agreed response times.","When the relationship ends, remove all access, get data returned or deleted with documentation, and move the service according to the exit plan."],"da":["Opbyg et register over alle leverandører med adgang til jeres data, systemer eller lokaler, inklusive cloud- og SaaS-tjenester, og udpeg en intern ejer af hvert samarbejde.","Klassificér leverandørerne efter kritikalitet og adgang til data, så de vigtigste får det grundigste eftersyn.","Fastsæt sikkerhedskrav, før I køber, og bed kritiske leverandører om dokumentation som et ISO/IEC 27001-certifikat, hvis omfang dækker ydelsen, en ISAE 3402- eller ISAE 3000-erklæring eller en SOC 2 type 2-rapport.","Skriv kravene ind i kontrakten, herunder frister for underretning om hændelser, auditret, regler for underleverandører, en databehandleraftale, hvis der indgår personoplysninger, og exitvilkår.","Giv kun leverandører fjernadgang via navngivne konti med MFA, logning og tidsbegrænsning.","Følg op på kritiske leverandører mindst én gang om året ved at gennemgå nye erklæringer, hændelser og ændringer, og vurdér klassificeringen igen.","Tag de vigtigste leverandører med i jeres planer og øvelser for hændelseshåndtering og driftskontinuitet, med kontaktoplysninger og aftalte responstider.","Når samarbejdet ophører, så fjern alle adgange, få data tilbageleveret eller slettet med dokumentation, og flyt ydelsen efter exitplanen."]},"pitfalls":{"en":["Classifying suppliers once at onboarding and never again.","Accepting a certificate without checking that its scope covers the service you actually buy.","Overlooking subcontractors and fourth parties, such as a SaaS provider's own hosting.","Leaving supplier remote access permanently open without MFA or logging."],"da":["At klassificere leverandørerne én gang ved onboarding og aldrig igen.","At godtage et certifikat uden at tjekke, at omfanget dækker den ydelse, man faktisk køber.","At overse underleverandører og fjerdeparter, fx en SaaS-udbyders egen hosting.","At lade leverandørers fjernadgang stå permanent åben uden MFA eller logning."]},"guides":[{"title":"Good Practices for Supply Chain Cybersecurity","url":"https://www.enisa.europa.eu/publications/good-practices-for-supply-chain-cybersecurity","publisher":"ENISA","tier":"official-doc"},{"title":"NIST SP 800-161 Rev. 1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations","url":"https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final","publisher":"NIST","tier":"standard"},{"title":"Supply chain security guidance","url":"https://www.ncsc.gov.uk/collection/supply-chain-security","publisher":"NCSC UK","tier":"official-doc"},{"title":"Cybersikkerhed i leverandørforhold","url":"https://samsik.dk/publikation/cybersikkerhed-i-leverandoerforhold/","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/data-breach","why":{"en":"Clear demands and checks lower the chance that a supplier leaks your data.","da":"Klare krav og kontrol mindsker risikoen for, at en leverandør lækker ens data."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"ai/shadow-ai","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/supply-chain-attack","why":{"en":"Checking suppliers' own security before trusting their software or access shrinks the chance they become the way in.","da":"At kontrollere leverandørers egen sikkerhed, før man stoler på deres software eller adgang, mindsker risikoen for, at de bliver vejen ind."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"Directive (EU) 2022/2555 (NIS2 Directive), Article 21(2)(d)","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj","tier":"standard","publisher":"European Union"},{"title":"ISO/IEC 27002:2022, Controls 5.19-5.22 (Supplier relationships)","tier":"standard","publisher":"ISO/IEC"}],"draft":true}