Requirement
In addition to implementing the ECC controls 4-1-2 and 4-1-3, the CSP shall cover the following additional subcontrols for third-party cybersecurity requirements, as a minimum:
Sub-Controls
4-1-P-1-1
Requirement: Ensure that the CSP fulfills NCA's requests to remove software or services, provided by third-party providers that may be considered a cybersecurity threat to national entities, from the marketplace provided to CSTs.
4-1-P-1-2
Requirement: Requirement to provide security documentation for any equipment or services from suppliers and third-party providers.
4-1-P-1-3
Requirement: Third-party providers compliant with law and regulatory requirements relevant to their scope.
4-1-P-1-4
Requirement: Risk management and security governance on third-party providers as part of general cybersecurity risk management and governance.
References
- ECC – 2:2024 equivalent: 4-1-2
- ECC – 2:2024 equivalent: 4-1-3
