Objectives of the Supplier Security Assurance Plan (SSA)
The purpose of the Supplier Security Assurance Plan (SSA) is to specify how providers comply with the cybersecurity requirements defined by the project owner as regards their organisation and their information system (IS). Every co-contractor or subcontractor concerned by cybersecurity must draw up an SSA.
This process must be initiated ahead of the outsourcing, that is to say before the purchasing process, from the call for tenders onwards. The SSA enables a client to require from its suppliers the IT security rules it imposes, and consequently the guarantees it wants. In an age when the cloud is all-powerful, this type of document is becoming widespread, in connection with the Information System Security Policy (ISSP), in particular its section on suppliers.
Example table of contents for the content of an SSA
- Presentation of the document
- Purpose
- Glossary and definitions
- Reference and associated documents
- Description of the service
- Security requirements
- Human resources security
- Recruitment
- Management of arrivals and departures
- ISS awareness and training
- Asset management
- Asset mapping
- Asset classification
- Protection of information
- Logical access management
- Access rights to resources
- Logical access control to the IS
- Management of authorisations
- Management of inactive sessions
- Traceability of access
- Management of identifiers/authenticators
- Password management
- Management of electronic certificates
- Physical security
- Physical access control to premises
- Traceability of physical access to premises
- Protection of physical security zones
- Security of IS operations
- Hardening of IT resources
- Backups and restoration
- Documentation of IT resources
- Management of security patches
- Protection against malicious code
- IS administration
- Communications security
- Communications security policy
- Securing data transmissions
- Remote access to the IS
- Access to the internal network from unmanaged equipment
- Development security
- Development rules
- Separation of environments
- Test data
- Change management
- IS maintenance
- Maintaining the IS security level
- Security of IS maintenance
- Disposal
- Relations with third parties
- Management of incidents and alerts
- Monitoring and management of technical vulnerabilities
- Detection and incident management arrangements
- Logging of incidents and alerts
- Crisis management
- Business continuity management
- Definition, implementation and maintenance of the business continuity plan
- Protection of backup data
- Updating systems and software
- Workstation security
- Use of personal devices
- User privileges on workstations
- Storage of information
- Protection of critical data
- Web browser configuration
- Documentation management
- Document repository
- Documentation management
- Monitoring and assessment
- Recurring checks of compliance with the ISSP
- One-off audits of compliance with the ISSP
- ISS reporting
- Human resources security
- Security organisation
- Responsibilities related to the SSA
- Procedures for changing the SSA
- Security measures
- Coverage of security requirements
- Follow-up documentation
Implementing an SSA
On the client side, this means first requesting a Supplier Security Assurance Plan (SSA), then defining a questionnaire for checks on a self-declaration basis. The next step is to establish a methodology for analysing the gap between the SSA and actual practices, taking internal and external constraints into account (contracts, good practices). The Supplier Security Assurance Plan is both a legal and a technical document. It has become necessary for all IT service providers wishing to reassure their customers, in particular processors within the meaning of the GDPR, to whom personal data is transferred.
Our certified partners support companies in drawing up their SSA and, more broadly, a security framework. They help clients define their requirements, obtain guarantees from the players in their ecosystem and then assess the gaps between what is declared and the reality.
➡️ The digitalisation of SSAs with the Make IT Safe solution.
