Security guide for ICT procurement : ICT procurement security guide for electronic communications service providers

The goal of this Security Guide for ICT Procurement is to support primarily electronic communications service providers but also ICT vendors with practical guidelines to better manage potential security risks in procured products or outsourced services which could lead to disruptions or outages in electronic communications services. In this Security Guide we map a set of security risks with security requirements which can be applied to vendors to prevent or mitigate those risks. The described risks and proposed security requirements are based on findings from a desk top study, a questionnaire with 29 providers and interviews with 10 providers and 2 vendors. We hope that the Security Guide for ICT Procurement will be useful for providers when negotiating and collaborating with ICT product vendors or outsourcing partners and for vendors when developing and managing the security of their portfolio of products and services.