Indicator

Risk description

Possible solutions

References

General

Misuse of the economic operator’s information system to endanger the supply chain.

Deliberate destruction or loss of relevant information.

the presentation of an ISO 27001 certificate demonstrates high standards in IT security;

procedures for authorised access to documents;

filing and secure storage of documents;

procedures for dealing with incidents and taking remedial action;

recording and back-up of documents, including scanning;

contingency plan to deal with losses;

possibility to use encryption software if needed;

commercial agents to be aware of security measures while travelling (never consult sensitive documents in transport);

set up access levels to strategic information according to different categories of personnel;

handle discarded computers in a secure manner;

arrangements with business partners for protecting/use of documentation.

SAQ - 3.8

ISO 28001:2007, section A 4

ISO 27001:2013

Security and safety requirements imposed on others

Misuse of the economic operator’s information system to endanger the supply chain.

Deliberate destruction or loss of relevant information.

requirements to protect data included in contracts;

procedures to control and audit the requirements in contracts.