UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities
SyDP 7.2 Information security – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.2-TPASS: Ongoing assurance of third-party suppliers

Dutyholders monitor third-party CS&IA effectiveness through the contract, at least reviewing the assessment annually and on notifiable events, with the frequency reflecting contract risk and supplier maturity and written into a security aspects letter or similar. Suppliers must notify incidents affecting SNI, changes to business, technology or threats, and changes of location, ownership or security managers. Deficiencies must be remedied in a contractually enforced timeframe, possibly with financial penalties, and suppliers are told of their NISR obligations and ONR oversight. Supplier risk is integrated with the dutyholder's risk management and governance, for example through a security working group that shares threat information and lessons learned.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in SyDP 7.2 Information security – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities controls