Requirement
In addition to the ECC subcontrols within controls 4-1-2 and 4-1-3, cybersecurity requirements for third-party cybersecurity in OT/ICS must include, at a minimum, the following:
Sub-Controls
4-1-1-1
Requirement: Cybersecurity requirements are included during procurement lifecycle for OT/ICS products and services.
4-1-1-2
Requirement: Cybersecurity requirements for third-party evaluation, selection, and information sharing must be defined.
4-1-1-3
Requirement: Third-party contractors and vendors must use formal and documented Secure Development Life Cycle (SDLC) practices for systems and components designed or deployed in OT/ICS environment.
4-1-1-4
Requirement: Periodic cybersecurity assessment and audits of third-party providers must be conducted to ensure the mitigation of any identified cyber threats.
References
- ECC – 2:2024 equivalent: 4-1-2
- ECC – 2:2024 equivalent: 4-1-3
