NIST CSF 2.0, GovernGV.SC-01

Establish a third-party risk management framework that sets out accountabilities, responsibilities, policies and processes for identifying, managing, mitigating, monitoring and reporting on risks from the use of third parties.

Employ cybersecurity professionals who hold a certification the Administration issues or recognizes, ensure the security of the supply chain of the technology products you use, obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system acquired by purchase, donation, development, or any other means, and ensure that any employee or officer with access to your critical assets holds a security clearance from the relevant government body.

Establish a supply chain security policy that governs your relations with your direct suppliers and service providers, and ensure, where appropriate, that your contracts with them specify an obligation to notify you without undue delay of incidents that present a risk to the security of your network and information systems (points 5.1.1 and 5.1.4(d)).

Manage ICT third-party risk as an integral, proportionate component of your ICT risk management framework, and, unless you are a microenterprise or an entity covered by Article 16(1), adopt and regularly review a strategy on ICT third-party risk.

Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).

Implement written policies and procedures, based on your risk assessment, designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers (persons who are not your affiliates or governmental entities, provide services to you, and maintain, process or are permitted access to your nonpublic information through those services).

If you own or operate critical elements of a public 5G network, design a supply-chain diversification strategy under which access-network equipment, systems and resources come from at least two different suppliers, and send it to the Ministry of Economic Affairs and Digital Transformation within six months of the decree-law's entry into force (Article 12(3) and the Second Additional Provision).