Requirement
The cybersecurity requirements for contracts and agreements with third-parties must be reviewed periodically.
Control Implementation Guidelines
- Review and update cybersecurity requirements for third party cybersecurity in the organization periodically according to a documented and approved plan for review and based on a planned interval or in the event of changes in relevant laws and regulations
- Document the review and changes to the cybersecurity requirements for third party cybersecurity in the organization and approve them by the head of the organization or his/her deputy
Expected Deliverables
- An approved document that sets the policy's review schedule
- Policy indicating that it has been reviewed and updated, and that changes have been documented and approved by the head of the organization or his/her deputy
- Formal approval by the head of the organization or his/her deputy on the updated policy (e.g., via the organization's official e-mail, paper or electronic signature)
