This requirement exists to assess, monitor, plan for, report on, review, and improve resilience of critical third parties and supply-chain dependencies, with specific focus on continuous improvement, so that critical services remain resilient against disruption and decisions are accountable and traceable.
Establish and document the process for continuous improvement. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently to critical services and their dependencies, and integrate it with risk management, business continuity, incident management, technology operations, and third-party management where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 10.1 – Continual improvement |
ISO
Standard
|
v2022 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 11) Vendor Risk Management – 11.1 Accountability for security risks in outsourced and partner arrangements; 11) Vendor Risk Management – 11.3 Due diligence, oversight and management of third-party vendors/service providers/partners; 19) Incident Response & Management – 19.5 Resilience capabilities and coordinated testing across interconnected systems, vendors and partners |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 28(1) – General principles for ICT third-party risk management Article 29 – Preliminary assessment of ICT concentration risk at entity level |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(d) – Supply chain security, including relationships with direct suppliers/service providers Article 21(3) – Supplier vulnerabilities, product/cybersecurity quality and secure development; critical supply-chain risk assessment results |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.08 – Conduct post-resumption review. 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.02 – Maintain business resilience. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.IR – Technology Infrastructure Resilience | PR.IR-03 – Mechanisms are implemented to achieve resilience requirements in normal and adverse situations PR.IR – Technology Infrastructure Resilience | PR.IR-04 – Adequate resource capacity to ensure availability is maintained GV.OC – Organizational Context | GV.OC-04 – Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.6 – CONTINGENCY PLANNING, 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CP-4 – CONTINGENCY PLAN TESTING, CA-7 – CONTINUOUS MONITORING |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Infrastructure Resiliency |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. |
AICPA
Audit Framework
|
vLatest | View → |