{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/supplier-management","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/supplier-management/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/supplier-management/"},"term":{"en":"Supplier management","da":"Leverandørstyring"},"aka":{"en":["supply-chain security","third-party risk management","vendor management"],"da":["sikkerhed i forsyningskæden","tredjepartsstyring"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"Making sure outside partners who handle your data or systems meet your security demands.","da":"At sikre, at eksterne partnere, der håndterer ens data eller systemer, lever op til ens sikkerhedskrav."},"body":{"formal":{"en":"The ongoing process of selecting, contracting, monitoring and exiting suppliers - as required by NIS2 Article 21(2)(d) and ISO 27002 controls 5.19-5.22 - so that the risks they bring are known and kept within the organisation's accepted limits.","da":"Den løbende proces med at vælge, indgå aftaler med, følge op på og afslutte samarbejdet med leverandører - som krævet i NIS2 artikel 21, stk. 2, litra d, og ISO 27002 kontrol 5.19-5.22 - så de risici, de bringer med sig, er kendte og holdes inden for organisationens accepterede grænser."},"plain":{"en":"You lock your own front door, but you also check that the cleaning company holding a spare key looks after it properly.","da":"Du låser din egen hoveddør, men tjekker også, at rengøringsfirmaet, der har en ekstra nøgle, passer ordentligt på den."},"inPractice":{"en":"Before a Danish hospital lets the maker of its infusion pumps log in remotely for maintenance, the procurement officer asks for the supplier's security report, writes breach-notice terms into the contract and books a yearly review.","da":"Før et dansk hospital lader producenten af dets medicinske pumper logge ind udefra for at vedligeholde dem, beder indkøberen om leverandørens sikkerhedsrapport, skriver krav om besked ved brud ind i kontrakten og aftaler en gennemgang hvert år."},"whyItMatters":{"en":"Attackers often go through the weakest supplier to reach many customers at once, so an organisation's security is only as strong as that of the partners it lets in.","da":"Angribere går ofte gennem den svageste leverandør for at ramme mange kunder på én gang, så en organisations sikkerhed er kun så stærk som de samarbejdspartnere, den lukker ind."}},"deepDive":{"en":"ISO/IEC 27002:2022 splits the topic into five controls: 5.19 (information security in supplier relationships: define processes to manage the risks of using suppliers' products and services), 5.20 (addressing information security in supplier agreements), 5.21 (managing information security in the ICT supply chain, including sub-suppliers and components), 5.22 (monitoring, review and change management of supplier services) and 5.23 (information security for use of cloud services, new in 2022, covering acquisition, use, management and exit). The guidance assumes a lifecycle: classify suppliers by criticality and data access, set requirements before contracting, embed them in the agreement, monitor during the relationship and manage termination, including return or deletion of data and revocation of access.\n\nLegal drivers stack on top. NIS2 Article 21(2)(d) requires supply chain security, including security-related aspects of relationships with direct suppliers and service providers, and Article 21(3) requires entities to take into account each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, and its secure development procedures; Article 22 adds coordinated EU-level risk assessments of critical supply chains. The GDPR requires processors to provide sufficient guarantees (Article 28(1)), a written data processing agreement (databehandleraftale) with the content listed in Article 28(3), and prior authorisation for sub-processors (Article 28(2)). DORA goes furthest for financial entities, with a register of information on all ICT third-party arrangements and mandatory contractual provisions. NIST CSF 2.0 places the topic in the Govern function as GV.SC.\n\nAssurance comes in tiers: supplier questionnaires (self-assessments such as the CSA CAIQ or a customer's own), certificates (ISO/IEC 27001, checking that the scope actually covers the purchased service), independent assurance reports (ISAE 3402 or SOC 2 Type II covering a period of operation; in Denmark ISAE 3000 reports are common for data processors), and the customer's own audits. Technical signals such as external attack-surface ratings and SBOMs complement but do not replace them.\n\nCommon failure modes: tiering done once at onboarding and never revisited; contracts without breach-notification deadlines, audit rights or exit clauses; blind spots for fourth parties, such as a SaaS provider's own hosting and subcontractors; privileged remote access for suppliers without MFA, session logging or time limits; and trusting a certificate whose scope excludes the service actually used. Incidents such as the SolarWinds Orion compromise in 2020 and the MOVEit Transfer exploitation in 2023 showed how a single supplier can become the entry point to thousands of customers, which is why supplier management overlaps with software supply chain security rather than being a procurement formality.","da":"ISO/IEC 27002:2022 deler emnet i fem kontroller: 5.19 (informationssikkerhed i leverandørforhold: fastlæg processer til at styre risiciene ved at bruge leverandørers produkter og tjenester), 5.20 (informationssikkerhed i leverandøraftaler), 5.21 (styring af informationssikkerhed i IKT-forsyningskæden, herunder underleverandører og komponenter), 5.22 (overvågning, gennemgang og ændringsstyring af leverandørers ydelser) og 5.23 (informationssikkerhed ved brug af cloudtjenester, ny i 2022, der dækker anskaffelse, brug, styring og exit). Vejledningen forudsætter en livscyklus: klassificér leverandørerne efter kritikalitet og adgang til data, fastsæt krav før kontraktindgåelse, skriv dem ind i aftalen, følg op under samarbejdet og styr afslutningen, herunder tilbagelevering eller sletning af data og fjernelse af adgange.\n\nLovkravene lægger sig ovenpå. NIS2 artikel 21, stk. 2, litra d, kræver sikkerhed i forsyningskæden, herunder de sikkerhedsrelaterede aspekter af forholdet til direkte leverandører og tjenesteudbydere, og artikel 21, stk. 3, kræver, at enheden tager højde for hver direkte leverandørs særlige sårbarheder, den samlede kvalitet af dens produkter og cybersikkerhedspraksis og dens procedurer for sikker udvikling; artikel 22 tilføjer koordinerede risikovurderinger af kritiske forsyningskæder på EU-niveau. GDPR kræver, at databehandlere stiller tilstrækkelige garantier (artikel 28, stk. 1), en skriftlig databehandleraftale med det indhold, der står i artikel 28, stk. 3, og forudgående godkendelse af underdatabehandlere (artikel 28, stk. 2). DORA går længst for finansielle enheder med et informationsregister over alle aftaler med IKT-tredjepartsudbydere og obligatoriske kontraktbestemmelser. NIST CSF 2.0 placerer emnet i Govern-funktionen som GV.SC.\n\nSikkerheden for, at leverandøren lever op til kravene, kommer i niveauer: leverandørspørgeskemaer (selvevalueringer som CSA's CAIQ eller kundens egne), certifikater (ISO/IEC 27001, hvor man skal tjekke, at omfanget faktisk dækker den købte ydelse), uafhængige revisorerklæringer (ISAE 3402 eller SOC 2 type 2, der dækker en driftsperiode; i Danmark er ISAE 3000-erklæringer udbredte for databehandlere) og kundens egne audits. Tekniske signaler som eksterne vurderinger af angrebsfladen og SBOM'er supplerer, men erstatter dem ikke.\n\nTypiske fejl: leverandørerne klassificeres én gang ved onboarding og aldrig igen; kontrakter mangler frister for underretning ved brud, auditret eller exitklausuler; blinde vinkler for fjerdeparter, fx en SaaS-udbyders egen hosting og underleverandører; privilegeret fjernadgang for leverandører uden MFA, sessionslogning eller tidsbegrænsning; og tillid til et certifikat, hvis omfang ikke omfatter den ydelse, der faktisk bruges. Hændelser som kompromitteringen af SolarWinds Orion i 2020 og udnyttelsen af MOVEit Transfer i 2023 viste, hvordan én leverandør kan blive indgangen til tusindvis af kunder, og derfor overlapper leverandørstyring med sikkerhed i softwareforsyningskæden i stedet for at være en indkøbsformalitet."},"edges":[{"type":"requires","to":"security/risk","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/data-breach","why":{"en":"Clear demands and checks lower the chance that a supplier leaks your data.","da":"Klare krav og kontrol mindsker risikoen for, at en leverandør lækker ens data."},"confidence":"medium","strength":"normal"},{"type":"mitigates","to":"ai/shadow-ai","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/supply-chain-attack","why":{"en":"Checking suppliers' own security before trusting their software or access shrinks the chance they become the way in.","da":"At kontrollere leverandørers egen sikkerhed, før man stoler på deres software eller adgang, mindsker risikoen for, at de bliver vejen ind."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"Directive (EU) 2022/2555 (NIS2 Directive), Article 21(2)(d)","url":"https://eur-lex.europa.eu/eli/dir/2022/2555/oj","tier":"standard","publisher":"European Union"},{"title":"ISO/IEC 27002:2022, Controls 5.19-5.22 (Supplier relationships)","tier":"standard","publisher":"ISO/IEC"}],"draft":true}