Cyber Defense eMagazine May Edition for 2022

the chances of an organization checking “No” to these are slim to none.
operational issues, and distrust with your suppliers.
Thus, leading to potential
Another common way organizations secure their supply chain is through conducting supplier audits. This
will ensure that their suppliers are meeting the minimum requirements to continue conducting business
together. While this enforces trust between you and your supplier, the problem is that either the cost is
high, not only to you, but also to your supplier leading to push back and ultimately you are only touching
a subset of your suppliers. Additionally, it is important not to overload your suppliers as this can have a
negative impact.
The above two scenarios are the same problem that the Card Brands ran into when trying to implement
cybersecurity measures to their merchant network. So, learning from history we can look at what other
sectors are doing to build the foundation of a framework.
ISO 27001 is the most widely used Information Security Framework in the world, and for good reason. It
allows organizations to demonstrate they have the basic pillars and buy-in from upper management to
maintain information integrity. This can be used in place of multiple supplier audits minimizing the
overheard of your supplier. Not only that, but it also allows you to share a globally accepted accredited
certificate to your customers rather than a report. Finally, this is a language many within the
manufacturing industry already speak. Such as:
• Internal Audit
• Management Review
• Corrective Action
These are all things that our industry is used to speaking about, and part of their everyday life, through
their ISO 9001 certification. As cybersecurity professionals, we consistently strive to find ways to tie
security into other parts of the organization, and by doing so will provide the coverage we dream about.
By utilizing a framework like ISO 27001 it allows security teams to collaborate with teams such as quality,
operations, management as well as create efficiencies through integration of internal audits, and building
consistent corrective actions as a team to gain buy-in from the entire organization. Additionally, with this
framework you can add in additional compliance requirements, and it can be easily cross-walked to other
common frameworks such as NIST 800-171, and COBIT. Those are widely used successful frameworks,
however unlike ISO 27001 they cannot provide a trusted accredited certificate.
As the market develops, TÜV SÜD is starting to see requests for standards around Supply Chain (ISO
28000) and Business Continuity (ISO 22301). This is to ensure that organizations can continuously run
even in the chance of disruption, and we anticipate that these standards will continue to grow as we find
more flaws in the supply chain.
As each industry is unique so are their desires for supplier security, this has led to industry specific
standards across the Supply Chain. These are based upon the two major markets, and I anticipate this
will continue to be replicated by other industries throughout their supply chains.
Cyber Defense eMagazine – May 2022 Edition 140
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.