Supply Chain Security

32. The head of the cybersecurity entity or a person authorised by them must establish a supply chain security management procedure applicable to purchases of services, works or equipment relating to the design, development, deployment, use, maintenance, modernisation and/or ensuring the cybersecurity of network and information systems, in order to reduce the risks that may arise for those systems.

33. When establishing the supply chain security management procedure, the cybersecurity entity must provide for selection criteria for network and information systems suppliers, covering:

• 33.1. the supplier's compliance with the cybersecurity requirements laid down in the Description

• 33.2. quality requirements for network and information systems products and services

• 33.3. access management, including limiting the duration of access.

34. In its contracts with suppliers (including subcontractors), in so far as they relate to the services provided, the cybersecurity entity must provide for:

• 34.1. requirements for the supplier's compliance with this Description

• 34.2. the skills and/or training and/or certificates and/or qualifications required of the supplier's staff

• 34.3. the supplier's obligation to notify the cybersecurity entity of all major and/or other incidents relating to the entity's network and information systems as soon as the supplier becomes aware of the incident, and to provide the entity with a cyber incident investigation report

• 34.4. the right of the cybersecurity entity or its authorised service providers to audit the supplier's compliance with the Description (including unscheduled audits) and the supplier's obligation to enable such an audit to be carried out during the term of the contract or following a major incident

• 34.5. the obligation to ensure the management of vulnerabilities posing a risk to the cybersecurity entity's network and information systems

• 34.6. confidentiality and non-disclosure obligations

• 34.7. service levels (Service Level Agreement, SLA)

• 34.8. define the levels and conditions of supplier access (logical and physical) to the network and information system

• 34.9. provide for requirements applicable to the supplier's premises, equipment, maintenance of network and information systems, and transmission of information over networks

• 34.10. provide for the rights and obligations of the supplier and of the cybersecurity entity.

35. When approving the supply chain security management procedure, the cybersecurity entity must provide for risk assessment requirements for network and information systems service providers.

36. An essential cybersecurity entity must have concluded a contract (or contracts) with the internet service provider, where the data transmission service is essential for providing the service, providing for:

• 36.1. response to cyber incidents during normal working hours

• 36.2. response to cyber incidents outside working hours

• 36.3. uninterrupted provision of the internet service: 24 hours a day, 7 days a week

• 36.4. logging of service disruptions: 24 hours a day, 7 days a week

• 36.5. application of protection against disruption of the network and information system (Denial of Service, DoS).

37. An important cybersecurity entity must have concluded a contract (or contracts) with the internet service provider, where the data transmission service is essential for providing the service, which must provide for:

• 37.1. response to cyber incidents during normal working hours

• 37.2. uninterrupted provision of the service during normal working hours

• 37.3. logging of service disruptions during normal working hours

• 37.4. application of protection against disruption of the network and information system (DoS).

38. The cybersecurity entity must monitor the implementation of the cybersecurity requirements set out in the contract with the supplier.

39. The cybersecurity entity must have drawn up a list of suppliers, maintain it and, when contracts change, review and update it at the intervals provided for and when significant changes or significant incidents relating to suppliers occur.