Skip to content

Latest commit

 

History

History
17 lines (9 loc) · 1.62 KB

7-assess-supply-chain-for-trust-and-resilience.md

File metadata and controls

17 lines (9 loc) · 1.62 KB

7. Assess supply chain for trust and resilience

Do you trust all components of the service?

If you do not have confidence in the security and operation of a component of the service, then any assessment of the service could be undermined. You should build trust with the service provider to ensure that you are content with their supply chain security, including that of any third party products and services they rely on.

Can the actions of a single vendor impact security?

Communications services that are only supported by a single vendor carry certain risks with them. For example, there is a risk to the availability of the service if that vendor were to suffer a temporary outage, or go out of business entirely. Alternatively, the service may change and no longer meet these principles, if (for example) the vendor is taken over by another company.

You may prefer to use a standards-based communications service, which is supported by multiple vendors in an interoperable way. The existence of alternative providers reduces the dependence on a single vendor.

Are users able to communicate with contacts using different services?

Many organisations will wish to communicate securely with contacts outside of their own organisation. If a communications service does not allow this, then their members may revert to using an insecure service that does not meet these principles.

Where an organisation has requirements to securely communicate with people external to their organisation, they should choose a service that is interoperable with secure services used by partners.