Skip to main content

Suppliers / Third Parties

Overview​

Suppliers and third parties are part of the chain of responsibility and lie outside the Manual's domain of prescription.
The Manual tells the organisation what it must require, verify and record; it does not tell the supplier how to work — what is required of the supplier lives in the contract. A supplier that adopts the SbD-ToE will find its own practices here.

The boundary moves with the process, not with the contract: whoever is contracted to work inside the organisation's repositories, pipelines and environments operates inside its process, and the practices apply to them as to any team (Ch. 14, US-15 to US-20).

Key Responsibilities​

  • Comply with contractual security clauses (Ch. 14)
  • Deliver an up-to-date SBOM and evidence of compliance
  • Ensure that external components meet security requirements
  • Submit to periodic validation

Organisational Context​

They are critical for NIS2 and DORA, which mandate explicit management of the digital supply chain (Art. 21 NIS2, Art. 28-30 DORA) and continuous assessment of third parties.

Regulatory Framework​

Supply chain management is an explicit requirement in:

  • NIS2: Art. 21 - Supply chain cybersecurity risk management measures
  • DORA: Art. 28-30 - Management of third-party ICT risk

Activities by Chapter​

What the organisation requires, verifies and records, per chapter:

Ch. 05 - Dependencies and SBOM​

The organisation requires an up-to-date SBOM for the components delivered and verifies it at acceptance, to maintain complete traceability of the chain.

Ch. 08-09 - IaC and Containers​

The organisation requires vulnerability validation and digital signature on the IaC modules and images supplied, and verifies them before promotion.

Ch. 13 - Training and Onboarding​

The organisation requires and records the mandatory minimum training before granting access to systems or data (NIS2/DORA compliance).

Associated requirements:

Ch. 14 - Governance and Contracting​

The organisation sets the contractual security clauses, validates the supplier before onboarding, monitors compliance throughout the contract and carries out formal offboarding at the end.

Associated requirements:

Chapter References​

For full context and framing: