Implementation measure
Approve and follow through supplier services
Mapped requirements (5)
- A.5.19 · Informationssicherheit in Lieferantenbeziehungen (DE)
Supporting contribution
Sections 1 and 2 connect the specific service, responsibility, risk-based assessment and approval in the existing record. Actual assessment and decisions must be made for your own services.
- A.5.20 · Berücksichtigung der Informationssicherheit in Lieferantenvereinbarungen (DE)
Supporting contribution
Section 3 supports appropriate security agreements and traceable deviation decisions. Actual agreement, legal review and implementation remain necessary.
- A.5.21 · Management der Informationssicherheit in der IKT-Lieferkette (DE)
Supporting contribution
Section 3 includes relevant ICT subcontractors, critical components, integrity and support in selection and agreements. Real supply-chain information and suitable evidence still need to be obtained and evaluated.
- A.5.22 · Überwachung, Überprüfung und Änderungsmanagement von Lieferantendienstleistungen (DE)
Supporting contribution
Section 5 connects regular and change-triggered service reviews with change decisions and corrections in the existing record. Reviews, evaluation and follow-up work must actually be carried out.
- A.5.23 · Informationssicherheit bei Nutzung von Cloud-Diensten (DE)
Supporting contribution
Sections 4 and 5 support the cloud lifecycle through specific task allocation, your own use, reviews, changes and exit. They do not prove actual configuration or implementation.
Further framework mappings of this measure
TISAX · 6.1.1
VDA ISA 6.0.3 · Partial contribution
The joint workflow supports risk-based selection and assessment of security-relevant services, suitable agreements and review of contractors and partners. Actual assessments, completed agreements, review results and applicable additional requirements remain to be evidenced. This is not a separate cloud ISA crosswalk or a claim to full objective fulfilment.
Read the source ↗