Connected Places Cyber Security Principles

You cannot outsource your accountability to your suppliers, as you are the overall risk owner for your connected place. There may be areas of split responsibility within your connected place that you may have with your suppliers, but it is still up to you to make sure the supplier fulfils this. You need to consider the role your suppliers have in building and operating your connected place. You should incorporate your suppliers' roles as part of your overall risk assessment process. This should include:

• What needs to be protected within your connected place, including systems assets and your citizens' privacy (and the level of protection required).
• How to communicate the minimum security requirements to your suppliers, how they will meet them, and what action will be taken in response to significant breaches of these requirements.
• Where operational technological capabilities are provided by the supplier to support bespoke business outcomes. This will bring bespoke risks with them which need to be analysed separately, as they will not fall within your minimum security requirements baselines. Further mitigations must also be implemented to deal with these bespoke risks.
• What assurance requirements need to be built into your connected place supply chain, and how these are going to be reported to you and your suppliers. Suppliers should be accountable for their security obligations as part of the contractual process.
• How your connected place supply chain is going to continuously improve its security, and build trust with your supplier.
• How your suppliers will report any suspicious or malicious activity, and assist you when needed.
• How readily you can change suppliers, should the need arise, and the level of support required to do so.
• What your exit strategy looks like (even if you hope not to use it).

Finally, you need to understand how you deal with risks associated with suppliers. This needs to include:

• Understanding the maturity of your suppliers' security protections. Will these protections meet your security requirements that will make compromise difficult, and reduce the impact of compromise to the threats you may face?
• Understanding the maturity of your suppliers' people security arrangements. Are your suppliers’ staff security educated to an acceptable level, with the awareness to spot suspicious activity, or potential physical or cyber attacks that you may face?
• Understanding the potential exploits and impacts that can occur from insider threats. Has your supplier performed risk assessments to understand their insider threat? Is there a plan to deal with insider risk ? Have they implemented effective controls to mitigate these insider risks? Have you considered implementing Privileged Access Management (PAM) to help support you?

Some countries seek to obtain sensitive commercial and personal data from overseas, including from the UK. Suppliers that are part of corporate groups based in these countries may be subject to influence from those governments to access and exfiltrate data from UK connected places, in support of those countries’ security and intelligence services. Such suppliers may also be used as a vector for an attempt to take down an essential service through denial of service methods to affect its availability, or through poisoning of the service through data manipulation or malicious code injection that could affect the integrity and availability of the service.

Methods by which a foreign government may be able to influence a supplier include the following: