Proportional Supplier and Contract Management Introduced for Information Security
Proportional Supplier and Contract Management (PLC) was introduced in October by the Informatiebeveiligingsdienst to help organizations manage information security risks across their supplier networks. The complete document set is extensive, prompting the release of an explanatory video series split into two parts for registered members.
The framework provides a structured approach for handling vendor relationships through specific classifications and contract requirements.
Supporting Documents and Classification Processes
The PLC framework relies on several core documents to determine supplier risk levels and enforce corresponding controls. The classification process document outlines how to evaluate a supplier through service-criticality, chain-position, and autonomy analyses to establish an appropriate assurance level.
Contract requirements are mapped directly to these assurance levels, detailing specific security measures, GIBIT foundations, and required actions. Additional documents cover contract execution tasks such as SBOM, exit plans, TPM, control rights, incident reporting, and continuity agreements. The CISO action list governs onboarding and periodic checks during contract management.
Templates and Operational Registers
Practical implementation is supported by a standardized deviation form that records temporary exceptions to contract requirements with a formal justification and timeline. A classification worksheet guides users through vendor categorization, requiring formal ratification for assurance level 3.
GIBIT activation templates allow organizations to formally request rights like SBOM and TPM from vendors. Central registers track overall supplier classifications, assurance levels, and received SBOMs, while a standardized review form supports periodic vendor evaluations.
Frequently Asked Questions
Who can access the PLC explainervideo and audio materials?
The explainervideo and audio content from the qeep talking podcast are exclusively available to (free) registered members of qeep posted.
What does the supplier classification process involve?
The process includes a service-criticality analysis, a chain-position analysis, and an autonomy analysis to establish the final assurance level for each vendor.
How are exceptions to security requirements handled?
Organizations can use the PLC deviation form to record and justify temporary departures from contract or assurance requirements alongside a defined time path.
Worth a look