Essential Cybersecurity Controls (ECC – 2 : 2024) Third-Party Cybersecurity
To ensure the protection of assets against the cybersecurity risks related to third-parties including outsourcing and managed services as per organizational policies and procedures, and related laws and regulations.
-
4-1-1
Cybersecurity requirements for contracts and agreements with third-parties must be identified, documented and approved.
-
4-1-2
The cybersecurity requirements for contracts and agreements with third-parties (e.g., Service Level Agreement (SLA)) -which may affect, if impacted, the organization's data or services- must include at least the following:
-
4-1-3
The cybersecurity requirements for contracts and agreements with IT outsourcing and managed services third-parties must include at least the following:
-
4-1-4
The cybersecurity requirements for contracts and agreements with third-parties must be reviewed periodically.
Need help putting this into practice? See our NCA ECC compliance services or read our NCA ECC articles.
See LakeRidge in action.
Talk with our team about your framework, your gaps, and the right plan.
Get a demo