Connected Places Cyber Security Principles

Supply chain controls need to instil confidence and trust to ensure your connected place has the right levels of protection. This needs to be effectively managed by the supplier to reduce the risk to systems and data under their control. You should encourage your supply chain to consistently improve its security hygiene (alongside your security requirements) to deal with the same sort of threats that constantly lead to issues such as malware or ransomware.

To do this, you need to make sure:

• You have clarified with your supplier what level of security is required for your connected place. You can do this by establishing a minimum set of cyber security and functionality expectations and hold your suppliers to account contractually.
• You have the mechanisms to check that the protections your supplier has in place meet the level of security required for your connected place. You should implement the 'right to audit' into all contracts and exercise this.
• Your supplier is actively monitoring the threat landscape and adjusting the protections that they have in place to deal with these threats.
• You have identified risks, and your supplier has a part in mitigating them. You need to specify these risks and hold your supplier to account contractually.
• Your supplier actively identifies potential risks and assesses their security performance within your supply chain. Where the level of security falls below the level of security required for your connected place, they need to provide upward reporting to you immediately, so you can proactively manage them.
• Your supplier supports your connected place throughout its lifetime.
• Where you identify suspicious events within your supply chain, you need to have an incident management and response plan to help you manage these incidents quickly and effectively.

For more information, please refer to the NCSC's guidance on Supply Chain Security.