ISO/IEC 27036-3: 信息安全供应商关系管理指南
版权申诉
5星 · 超过95%的资源 169 浏览量
更新于2024-07-18
收藏 14.8MB PDF 举报 "ISO IEC 27036-3是国际标准化组织（ISO）与国际电工委员会（IEC）联合发布的关于信息安全供应商关系管理的标准，主要关注信息和通信技术（ICT）供应链的安全。这份标准提供了针对ICT供应链安全的指南，旨在帮助企业和组织确保其供应链在提供产品和服务过程中的安全性，防止潜在的信息安全威胁。
标准的前言提到，ISO/IEC 27036-3是2013年首次发布，它包含了对供应商关系管理的详细指导，特别关注了供应链的安全问题。这个标准对于那些依赖于ICT服务和产品的组织尤其重要，因为它提供了确保业务连续性和数据保护的方法。
标准的内容结构如下：
1. 范围：这部分定义了标准适用的范围，可能包括ICT产品和服务的采购、设计、开发、生产、交付、维护和废弃等阶段的安全管理。
2. 规范性引用文件：列出其他相关标准和技术文档，这些文档对于理解和实施本标准是必要的。
3. 术语和定义：定义了在标准中使用的专业术语，以便于统一理解和应用。
4. 标准结构：说明了标准的组成部分和章节分布。
5. 关键概念：
- 业务案例：阐述了为什么需要关注ICT供应链安全，可能涉及风险、成本和信任等因素。
- ICT供应链风险和相关威胁：详细分析了供应链中可能出现的安全风险和相应的威胁源。
- 采购者与供应商关系类型：描述了不同类型的业务关系如何影响安全策略。
- 组织能力：讨论了组织需要具备的能力，以有效管理和应对供应链安全问题。
- 系统生命周期过程：强调了从需求分析到退役的整个生命周期中应考虑的安全控制。
- ISMS（信息安全管理系统）过程：介绍如何将ISMS的原则和实践应用于供应链管理。
该标准提供了一个框架，帮助组织评估和控制供应商的风险，确保供应链的每个环节都符合安全要求。通过遵循这些指南，组织能够建立信任，确保供应链的透明度，并降低由于供应商行为导致的安全事件的风险。这有助于提升整体的信息安全水平，保护企业的资产和声誉，同时增强客户和合作伙伴的信心。"
4
1S0/IEC
27036-3:2013(E)
5 .. 4
Organizational
capability
To
manage
risks
assoc·ated
with
the
ICT
supply
chain
throughout
I
CT
produc
sand
services
lifecyde,
acquirers
and
suppliers
should
implement
an
organizational
capability
for
managing
information
security
aspects
of
suppUer
relationships.
This
capability
should
establish
and
monitor
IC1'
supply
chain
security
objectives
for
the
acquirer
organization
and
monitor
achievement
of
these
object
·
ves
including
at
least
the
following:
aJ
Define,. select,
and
implement
the
strategy
for
management
of
information
security
risks
caused
by
ICT
supply
chain
vulnerabilities;
1)
Establish
and
maintain
a
plan
for
identifying
potential
ICT
supply
chain-related
vulnerabilities
before
they
are
exp]oited;
in
ad
d
it
ion,
have
a
p]an
for
mitigating
adverse
impacts.
2) Identify
and
document
Information
security
risks
associated
with
the
IC
T
supply
chain-related
threats,
vulnerabilities,
and
consequences
(see
C]ause
6.
3.4
).
b)
Establish
and
adhere
to
baseline
information
security
contro~s
as
a
prerequisite
to
robust
sup
,
plier
relationships
(see
An
nex
B
for
a
mapping
of
Claus
e 6
to
ISO/IEC
270
02).
c)
Establish
and
adhere
to
baseline
system
and
software
lifecycle
processes
and
practices
for
establishing
robust
supplier
relationships
in
regards
to
IC
T
supply
chain
information
security
risk
management
concerns
(see
C]
ause
6).
d)
Have
a
set
of
baseline
informat
ion
security
requirements
that
apply
to
an
supplier
relationshi
ps
and
tailor
them
for
specific
suppliers
as
needed
.
e)
Establish
a
repeatable
and
testable
process
for estabHshi.ng
information
security
requirements
associated
with
new
supplier
re]ationships,.
managing
existing
supplier
re]ationsh
ips
,
verifying
and
validating
that
suppJiers
are
complying
with
acqui.rer's
information
security
requirements,
and
ending
supplier
relationships.
f)
Establish
change
management
processes
to
ensure
changes
that
potentially
affect
information
security
are
ap
proved
and
applied
in
a
timely
manner.
g) Define
methods
for
identifying
and
managing
inc1dents re]a
ted
to
or
caused
by
IC
T
supp]y
chain
and
for
sharing
information
about
the
incidents
with
suppHers
and
acquirers.
5.5
System
lifecycle
processes
l '
fecyde
processes
can
help
set
expectations
between
acq
u
irers
and
suppliers
for
rigor
and
accountability
with
regards
to
information
security.
Acquire
rs
can
irnp]ement
Hfecyde
processes
internally,
to
increase
the
rigor
with
which
they
estabHsh
and
manage
supp]
ier
relationships.
Suppliers
can
imp[ement
lifecyde
processes
to
help
demonstrate
rigor
that
suppliers
apply
to
system
and
software
processes
with
respect
to
supplier
relationship
,s.
While
havin
g
those
processes
in
pl
ace
will
be
helpful
for
both
acquirers
and
suppliers
in
beginning
to
address
JCT
supply
chain
risks,.
add
i
tional
JCT
supply
chain
security
activ
ities
should
be
integrated
into
those
processes.
Systems
and
software
prese
nt
many
of
the
ICT
supply
chain
risks
..
Using
a
Hfecyde
apprnach
prov
ided
in
ISO/IEC
15288
and
1SO/IEC
12207
offers
an
established
way
of
managing
those
risks.
Both
standards
provide
a
set
of
the
same
processes
as
they
app
ly
to
the
specific
context
of
systems
or
software.
1S0/IEC 12.207 is a special
case
of
applying ISO/I
EC
1
5288.
Both
standards
aHow for
the
use
of
any
lifecycle or ]ifecycle
mode
and
present
a
set
of
processes
that
can
be
used
within
any
Ufecycle
or
any
1
ifecyde
phase
as
appropriate.
Fo
r
example,
th
e
Configuration
Management
process
can
be
used
both
during
system
or
software
devetopment
and
in
ope
ratio
ns
and
maintenance
Hfecycle
phases.
l'his
standard
adopts
the
same
approach
as
those
two
standards,
describing
each
process
at
a
summary
level
by
a
statement
of
purpose
and
then
decomposing
each
process
into
practices.
Clause 5,8
provides
a
summary
of
specific
ICT
supply
cha
in
security
practices
. Cl
ause
6
provides
a
mapping
of
these
ICT
supply
chain
security
activities
for
each
Hfecycle
process.
Acquire
rs
and
suppliers
should
select
those
activ
i
ties
that
are
relevant
to
their
organization's
supplier
relationship
cap
abili
ties,
© 1S0/IEC
2013
-A
ll
rights
reserved
poorest
剩余41页未读，继续阅读
2022-11-24 上传
2023-08-26 上传
2021-09-03 上传
2021-09-03 上传
2022-11-24 上传
2022-11-24 上传
点击了解资源详情
点击了解资源详情
alarmano
- 粉丝: 26
- 资源: 1万+
我的内容管理
展开
最新资源
- SSM动力电池数据管理系统源码及数据库详解
- R语言桑基图绘制与SCI图输入文件代码分析
- Linux下Sakagari Hurricane翻译工作：cpktools的使用教程
- prettybench: 让 Go 基准测试结果更易读
- Python官方文档查询库，提升开发效率与时间节约
- 基于Django的Python就业系统毕设源码
- 高并发下的SpringBoot与Nginx+Redis会话共享解决方案
- 构建问答游戏：Node.js与Express.js实战教程
- MATLAB在旅行商问题中的应用与优化方法研究
- OMAPL138 DSP平台UPP接口编程实践
- 杰克逊维尔非营利地基工程的VMS项目介绍
- 宠物猫企业网站模板PHP源码下载
- 52简易计算器源码解析与下载指南
- 探索Node.js v6.2.1 - 事件驱动的高性能Web服务器环境
- 找回WinSCP密码的神器：winscppasswd工具介绍
- xctools：解析Xcode命令行工具输出的Ruby库
