This is based on my experience as an IT Security and Compliance consultant, and leans on ISO 27001. Some of the words in this article, mirror what I say in the linkedin post. I argue that rule one is to have a policy which must deal with how to apply a risk based approach to the supply chain. This means segmenting suppliers into value or risk classes, using a classic risk matrix of estimating probability of failure vs…
