Managing information security in the ICT supply chain

Why it matters

A compromised upstream dependency (a library, a hosting provider) can compromise you without any mistake on your part.

How a self-led small team implements it

List your critical infrastructure dependencies and note each one's security posture in one line — depth follows over time.

What auditors expect to see

Supply chain risk register or dependency list.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities