NIST CSF 2.0, GovernGV.SC-06

Undertake due diligence before entering a contract or other arrangement with a third party, and on an ongoing basis, in proportion to the risk and criticality of the arrangement.

Where a supplier implements a security measure on your behalf, select that supplier consistent with the measure's requirements and write those requirements into your contract with the supplier.

Contract only testers that meet Article 27(1): of the highest suitability and reputability, with technical and organizational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, certified by an accreditation body in a Member State or adhering to formal codes of conduct or ethical frameworks, able to provide an independent assurance or an audit report on the sound management of the risks of TLPT, and covered by professional indemnity insurance. Use internal testers only with the approval of your competent authority or the designated single public authority, contract external testers every three tests, use only external testers if you are a credit institution classified as significant under Regulation (EU) No 1024/2013, and ensure that the threat intelligence provider is external to you (Article 26(8) and Article 27(1) and (2)).

Before entering into an ICT services contract, assess whether it supports a critical or important function, whether supervisory conditions for contracting are met, and the concentration risk under Article 29, including whether the provider is easily substitutable and whether you already rely on it, or a closely connected provider, for other critical functions.

In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the choice of those measures must also take account of their capacity to be audited, the transparency of their operation, their interoperability, their resilience and the control they give over your information systems, so as to minimize technological dependence on third-party providers that give insufficient guarantees of compliance with the cybersecurity and digital sovereignty requirements set by the national strategy, and the fourth objective covers the resilience of your activities, networks and information systems.

If you are an ICT critical infrastructure owner or lawful possessor, buy technical resources for a class A information system only from a supplier and manufacturer that meet the registration, board, beneficial-owner and shareholder conditions of point 94, unless point 95 lifts them, and obtain the Constitution Protection Bureau's opinion before contracting for services to a class A system (points 93 and 94).

If you hold the right to use radio frequencies and intend to use equipment, devices or software from other manufacturers or suppliers, or other maintenance and support providers, than those you declared, notify the Communications Regulatory Authority first, and do not use them for electronic communications activity until the national security vetting finds the supplier meets national security interests (Article 69(5)).

Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11).

The Department says your third-party service provider policies should include due diligence guidelines before you use a provider with access to your information systems or nonpublic information, strongly recommends that you consider the threats AI poses to those providers, and says you should require providers to give timely notice of any cybersecurity event that directly impacts your information systems or the nonpublic information they hold, and should consider additional representations and warranties where providers use AI.

Address in those policies, to the extent applicable: the identification and risk assessment of third-party service providers; the minimum cybersecurity practices they must meet to do business with you; the due diligence you use to evaluate the adequacy of their cybersecurity practices; and periodic assessment of them based on the risk they present and the continued adequacy of their practices.

Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.

Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.

Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.

Where you rely on third-party vendors or cloud service providers for AI and ML, conduct due diligence on the provider's reputation in AI, governance, security and data protection practices, include contract provisions for access to relevant information, audit rights and compliance with CBUAE requirements, and remain responsible for outsourced AI functions (Sections 6(e) and 9(a)).

Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.