What is the purpose of the prior assessment when contracting information security management activities?

The purpose of the prior assessment is to evaluate suppliers' competencies, sustainability, and qualifications in relation to the information security activities to be contracted. It may need to be carried out taking into account other legal requirements or procurement procedures that apply to the competent authority.

What are the different ways to carry out the prior assessment for contracting information security activities?

The prior assessment may be carried out in different ways, such as: (a) in case of public bids, inclusion of eligibility requirements in the procurement documents for potential suppliers; (b) review of information security certifications granted by external and impartial auditors to potential suppliers; (c) review of self-assessment questionnaires compiled by potential suppliers.

What should the risk assessment associated with the provision of contracted information security activities take into account?

The risk assessment should take into account the maturity level of the contracted organisation and should consider: (a) identification and assessment of critical and sensitive information and assets that may be shared with or provided by external suppliers; (b) identification of the information security requirements of the authority applicable to the contracted organisation; (c) evaluation, by means of a supplier assessment, of the ability of the contracted organisation (both existing and new) to meet the authority's information security requirements; (d) assessment of risks that may be introduced by the contracted organisation.

How can the prior assessment be conducted in the case of public bids?

In the case of public bids, the prior assessment can be conducted by inclusion of eligibility requirements in the procurement documents for the potential suppliers.

What is the role of self-assessment questionnaires in the prior assessment?

The prior assessment may include a review of self-assessment questionnaires compiled by the potential suppliers.

What risks introduced by the contracted organisation should be assessed?

The risk assessment should include an assessment of risks that may be introduced by the contracted organisation.

What is the maturity level of the contracted organisation used for in the risk assessment?

The risk assessment should take into account the maturity level of the contracted organisation as a factor in evaluating the risks associated with the contracted activities.

GM4 IS.AR.220 Contracting of information security management activities

Q: What should the agreed risk assessment also consider besides the listed risk factors?

The agreed risk assessment should also consider the roles and responsibilities of the parties (i.e., competent authority and contracted organisation) as well as their interfaces.

Q: What is the role of information security certifications in the prior assessment?

The prior assessment may include a review of the information security certifications granted by external and impartial auditors to the potential suppliers.

Q: What does the risk assessment consider regarding critical and sensitive information?

The risk assessment should consider the identification and assessment of critical and sensitive information and assets that may be shared with, or provided by, external suppliers.

Q: What does the risk assessment consider regarding the authority's information security requirements?

The risk assessment should consider the identification of the information security requirements of the authority that are applicable to the contracted organisation.

Q: How is the ability of the contracted organisation to meet information security requirements evaluated?

The ability of the contracted organisation (both existing and new contracted organisations) to meet the information security requirements of the authority is evaluated by means of a supplier assessment.

Navigate / EASA

Ask question Discover more Add to collection

GM4 IS.AR.220 Contracting of information security management activities

ED Decision 2023/010/R

PRIOR ASSESSMENT

The purpose of the prior assessment is to evaluate suppliers’ competencies, sustainability as well as qualifications in relation to the information security activities to be contracted. This prior assessment may need to be carried out taking into account other legal requirements or procurement procedures that apply to the competent authority, and may therefore be carried out in different ways, such as:

(a) in case of public bids, inclusion of eligibility requirements in the procurement documents for the potential suppliers;

(b) review of the information security certifications granted by external and impartial auditors to the potential suppliers;

RISK ASSESSMENT ASSOCIATED WITH THE PROVISION OF THE CONTRACTED ACTIVITIES

The risk assessment should take into account the maturity level of the contracted organisation, and should consider the following:

(a) identification and assessment of critical and sensitive information and assets that may be shared with, or provided by, external suppliers;

(b) identification of the information security requirements of the authority that are applicable to the contracted organisation;

(c) evaluation, by means of a supplier assessment, of the ability of the contracted organisation (both existing and new contracted organisations) to meet the information security requirements of the authority;

(d) assessment of risks that may be introduced by the contracted organisation.

This agreed risk assessment should also consider the roles and responsibilities of the parties (i.e. competent authority and contracted organisation) as well as their interfaces.

Details

Source-Title: GM4 IS.AR.220 Contracting of information security management activities View latest amendments

Erulesid: ERULES-1963177438-21691 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/010/R Navigate

Regulatorysubject: Part-IS.AR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.AR.220 Contracting of information security management activities

Origin: EASA

Category: EAR