Agreeing concrete security requirements with vendors

Requirements must be phrased so they can be verified

Statements such as “appropriate security” need operational substance. Define, for example, deadlines for critical vulnerabilities, reporting paths for incidents, required recovery objectives and the evidence to be provided.

Technology and governance belong together

UP KRITIS structures possible requirements through, among others, vulnerability and patch management, system hardening, remote access, secure development, operations, incident reporting, audits and non-technical security.

• roles, contacts and escalation
• vulnerability, patch and incident deadlines
• subcontractors and change notification
• audit, data return, deletion and exit