Information, digital suppliers and operational environments
Cybersecurity and digital trust
Continuity depends on information, digital services and operational systems, many of them provided by third parties.
Questions for decision-makers
- Which services depend on outside providers?Map critical digital suppliers and the data they handle.
- Which controls are evidenced?Distinguish documented controls from controls that have been tested.
- How are incidents handled?Detection, response and communication should be defined before an event.
- What is the scope?An information security certificate covers a defined scope, not the whole organisation by default.
Limits that matter
Document-based evaluation is different from intrusive technical testing. Penetration tests and similar activities require specific authorisation, scope and qualified specialists.
Related service
In development
Digital third-party risk assessment
Assessment of risks introduced by digital service providers that handle information or support critical operations.
Reference sources
Standards are cited as references that are explained. Citing a standard does not mean that IAC has evaluated any organisation against it.