GRCLibrary.ai

Standard

Supplier Security and Privacy Assurance Standard

This standard defines the minimum information security and privacy assurance requirements that suppliers, processors, and other third-party service providers must meet as a condition of doing business with the organization. It establishes the evidence and contractual obligations the organization requires, and the assessment methods used to verify compliance.

Type
Standard
Version
1.1.15
Date
2026-10-16
Owner
Supplier Risk Maintainer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Supply Chain Governance: Security and Privacy
Review frequency
Annual and upon material regulatory change or significant supplier incident
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Minimum security requirements by tier
  • 4. Privacy assurance requirements
  • 5. Assurance evidence hierarchy
  • 6. Minimum contract clauses
  • 7. Ongoing assurance activities
  • 8. Non-compliance and escalation
  • 9. Metrics
  • 10. Framework alignment

Frameworks it maps to

Related documents