What it covers. A multi-part international standard on managing information security risks in supplier relationships. Its parts cover an overview and concepts, requirements for defining and managing supplier relationships, guidance for hardware, software and services supply chains, and guidance for securing cloud services.
In practice. Applying it well means building information security into the full supplier life cycle: planning, selection, contracting, ongoing management and termination. Both acquirer and supplier responsibilities are defined, and security requirements flow into agreements and to sub-suppliers where relevant. Evidence includes a supplier management process, risk-based due diligence, contract clauses, monitoring records and exit plans.
Common gaps. Typical gaps are focusing only on contract signature, no exit or transition planning, and little visibility into the supplier's own suppliers.