Supply chain cyber security policies

Supply chain cyber security policy (standard) contents

1. Introduction: purpose of cyber security document;
   Provider
    to protect
   Customer
    interests regarding cyber security.
2. Definitions: definitions.
3. Status of 
   this Policy
   : document forms part of contract.
4. Cyber security risks: cyber security is a strategic risk; reference to identified risks; Data protection impact assessments; cyber security risk assessments.
5. Cyber security approach: processing data compliance;
   Provider
    to maintain minimum level of security ;
   Provider
    to maintain adequate level of security;
   Provider
    to maintain equivalent level of security.
6. Cyber security requirements: compliance with applicable standards; implementation of cyber security controls (access); cyber security training requirements; implementation of technical controls.
7. Actions upon termination: managing termination of contract; provision of data on contract termination ; deletion of
   Customer
   data ; provision of a record of data retained by the other party; access credentials revoked; requirements remaining in force.

ANNEX 1 (EVIDENCE REQUIRED OF COMPLIANCE)

List of evidence of compliance with cyber security policy.

ANNEX 2 (ADEQUATE ENCRYPTION STANDARDS)

List of adequate encryption standards.

Supply chain cyber security policy (premium) contents

1. Introduction: purpose of cyber security document;
   Provider
    to protect
   Customer
    interests regarding cyber security.
2. Definitions: definitions.
3. Status of 
   this Policy
   : document forms part of contract.
4. Cyber security risks: cyber security is a strategic risk; reference to identified risks; Data protection impact assessments; cyber security risk assessments.
5. Cyber security approach: processing data compliance;
   Provider
    to maintain minimum level of security ;
   Provider
    to maintain adequate level of security;
   Provider
    to maintain equivalent level of security.
6. Cyber security requirements: compliance with applicable standards; implementation of cyber security controls (access); cyber security training requirements; implementation of technical controls.
7. Evidential requirements and auditing: evidence of meeting cyber security requirements; reducing risks; independent audit to prove compliance; requirement of audited standards compliance evidence; evidence of self-assessed compliance; ongoing standards compliance.
8. Detecting cyber security breaches: logging of system activities; retention of logs beyond the term; recording of system access; monitoring of system; compliance with laws when monitoring system; monitoring of system; review of system logs.
9. Responding to cyber security breaches: supply of logs for disciplinary action; supply of system logs in the event of a cyber security breach; supply of logs to third parties for investigation; revoking of access to the system; prohibition of employees accessing system; triggering an investigation following complaint; notification of unusual activity or mistakes; notification of breach in 
   Customer
    system; notification of breach in 
   Provider
    system; notifying Information Commissioner's Office in case of breach.
10. System and
    Policy
    reviews and updates: notification of changes to IT system; notification of changes to shared data/system; notification of new threats; notification of security vulnerability ; responsibility for reviewing policy; timing of updates; ad hoc reviews and updates; review considerations.
11. Actions upon termination: managing termination of contract; provision of data on contract termination ; deletion of
    Customer
    data ; provision of a record of data retained by the other party; access credentials revoked; requirements remaining in force.

ANNEX 1 (EVIDENCE REQUIRED OF COMPLIANCE)

List of evidence of compliance with cyber security policy.

ANNEX 2 (ADEQUATE ENCRYPTION STANDARDS)

List of adequate encryption standards.

ANNEX 3 (FORM OF NOTIFICATION OF CYBER SECURITY BREACH)

1. Introduction: identification of person giving cyber security breach notification.
2. Description of cyber security breach: prompt for description of cyber security breach.
3. Parts of 

   Provider

   System affected
   : prompt for specification of affected system parts.
4. Proportion of data assets affected: prompt for insertion of proportion of data assets affected.
5. Is personal data concerned?: details of effects of breach on personal data.
6. Likely consequences of breach: prompt to identify likely consequences of breach.
7. Measures taken to address breach: prompt to describe measures taken to address breach.
8. Has anyone other than
   the Customer
   been notified of the breach?: details of who has been notified of cyber security breach.
9. Late report of breach: reasons for later report of cyber security breach.
10. Contact details: details of person handling cyber security breach.