Control Objectives: Third Party and supply chain oversight

Categorize all suppliers in the supply chain management program.

Collect evidence of each supplier's supply chain due diligence processes.

Conduct all parts of the supply chain due diligence process.

Consultation with procurement to establish the applicable contractual requirements necessary to ensure the adequate protection of Roche confidential data and legal compliance with the processing of personal data.

Document the third parties compliance with the organization's system hardening framework.

Establish and maintain Service Level Agreements with the organization's supply chain.

Establish and maintain a Service Level Agreement framework.

Establish and maintain a supply chain management policy.

Establish and maintain procedures for establishing, maintaining, and terminating third party contracts.

Establish and maintain third party transaction authentication procedures.

Establish the third party's service continuity.

Formalize client and third party relationships with contracts or nondisclosure agreements as necessary.

In case the manufacturing system is managed by 3rd parties or vendor, the service provider should be assessed against cybersecurity requirements according to respective vendor risk assessment process.

In case the manufacturing system is managed by 3rd parties the SLA (Service Level Agreement) should be formally defined (e.g. support for incident or failure investigation and remediation).

Include Change Control clauses as appropriate in third party contracts.

Include a description of the data or information to be covered in third party contracts.

Include a reporting structure in third party contracts.

Include business requirements of delivered services in the Service Level Agreement.

Include compliance with the organization's access policy as a requirement in third party contracts.

Include compliance with the organization's privacy policy in third party contracts.

Include incident management procedures and incident reporting procedures in third party contracts.

Include risk management procedures in the supply chain management policy.

Include text about access, use, disclosure, and transfer of data or information in third party contracts.

Include text that signatories must meet organizational compliance requirements in third party contracts.

Include third party acknowledgement of their data protection responsibilities in third party contracts.

Include third party requirements for personnel security in third party contracts.

Monitor and report on the efficacy of all Service Level Agreements using a Service Level Agreement Monitoring Chart or equivalent.

Monitor third parties when they deliver services.

Perform a risk assessment prior to engaging a third party.

Require third parties to maintain a compliance framework equivalent to that of the organization's compliance requirements.

Review all Service Level Agreements.

Review all contracts.

Service provider holds a System and Organization Controls (SOC) report and the report is reviewed on a yearly basis by Roche Information Security.

Select suppliers based on their qualifications.

Third Party and supply chain oversight

This control mandates a formal assessment to ensure that third-party vendors meet Roche information security, privacy (VSA) and quality (VQA) requirements. This assessment must be performed before the software is used by Roche or connected (access granted) to our network, systems, or data. This proc

An assessment conducted to verify whether a vendor meets Roche’s information security and privacy requirements to process, host, and/or to have access to Roche’s network which includes business critical or personal data related to its services to Roche.

Verify third parties meet organizational compliance standards.