Security in third party agreements, A
Third-party agreement coverage is an average, and an average can hide a weak supplier.
What the published 2016 guidance says
Third-party agreement coverage is an average, and an average can hide a weak supplier. The construct counts the relevant security requirements addressed across agreements, divided by the number of agreements, as a percentage, with a target of 100. Evidence is the supplier database and the agreement records. It is collected quarterly and reported each semester. The contract office owns it, security staff collect, and the security and business managers are clients. The example warns that treating all requirements as equal can give a false sense of security, so suppliers should carry a rating or category rather than being measured as one group.
What it means in practice
Third-party agreement coverage is an average, and an average can hide a weak supplier. Pair it with a supplier rating so that a critical supplier with a gap is not averaged away. The evidence is the agreement and the requirement list, not the supplier's questionnaire alone.
Status of this record. For B.31, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the supplier list with a security rating and the agreement requirement list. Calculate the coverage and report it with the rating. Flag any critical supplier below the threshold. Review the requirement list yearly.
Evidence an assessor asks for
- Supplier relationshipsSupplier database with a security rating or category
- Contract managementPer-agreement checklist of required and addressed security requirements
- Supplier relationshipsTrend line with summary
The question an assessor will ask
An assessor will ask for supplier database with a security rating or category. The test for B.31 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- One requirement set applied to every supplier regardless of risk
- Average reported without the per-agreement variation
Before the next review
Before the next review, test this against one live record: one requirement set applied to every supplier regardless of risk.
What to check when the revision publishes
When DIS 27004 is published, compare the B.31 Security in third party agreements, A record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.