What is EN ISO 27035-3: 2018 ?

EN ISO 27035-3: 2018 is the international standard on information security for supplier relationships. It is part of the ISO/IEC 27000 series, which are global standards for managing information security. The purpose of EN ISO 27035-3: 2018 is to provide guidance to organizations on how to effectively manage the risks associated with information security when engaging with external suppliers.

EN ISO 27035-3: 2018 is made up of several key components, including the following:

Supplier Management Plan: This plan outlines the steps that an organization should take when engaging with a new supplier, including the due diligence process, the level of risk assessment, and the communication with the supplier.

Supplier Supplier Management Agreement: This agreement outlines the responsibilities and obligations of both the supplier and the organization, including the level of security required from the supplier, the reporting mechanisms, and the consequences of non-compliance.

Incident Management Plan: This plan outlines the steps an organization should take when a security incident occurs, including the incident response procedure, the communication with stakeholders, and the documentation of the incident.

Training and Awareness: This component outlines the training and awareness programs that an organization should implement to ensure that its employees are aware of the organization's security policies and procedures.

EN ISO 27035-3: 2018 is designed to help organizations establish a structured and systematic approach to incident management, which can minimize the impact of information security incidents on the organization's operations and reputation. By implementing this standard, organizations can ensure that they have the necessary information security controls in place to effectively manage the risks associated with their supplier relationships.