Indicator |
Risk description |
Possible solutions |
References |
General |
Misuse of the economic operator’s information system to endanger the supply chain. Deliberate destruction or loss of relevant information. |
the presentation of an ISO 27001 certificate demonstrates high standards in IT security; procedures for authorised access to documents; filing and secure storage of documents; procedures for dealing with incidents and taking remedial action; recording and back-up of documents, including scanning; contingency plan to deal with losses; possibility to use encryption software if needed; commercial agents to be aware of security measures while travelling (never consult sensitive documents in transport); set up access levels to strategic information according to different categories of personnel; handle discarded computers in a secure manner; arrangements with business partners for protecting/use of documentation. |
SAQ - 3.8 ISO 28001:2007, section A 4 ISO 27001:2013 |
Security and safety requirements imposed on others |
Misuse of the economic operator’s information system to endanger the supply chain. Deliberate destruction or loss of relevant information. |
requirements to protect data included in contracts; procedures to control and audit the requirements in contracts. |