Requirement
[A: M | B: R] Cybersecurity requirements must be defined, documented and approved within the entity's contracts and agreements with third parties (e.g., Service Level Agreements, SLA), containing at minimum:
Sub-Controls
3-1-1-1
Requirement: [A: M | B: R] A requirement to maintain the confidentiality of information.
3-1-1-2
Requirement: [A: M | B: R] Communication procedures in case of a cybersecurity incident at third parties whose compromise could affect the entity's data or the services provided to it.
