6. Supply Chain Security

6.1 Glesys manages supplier relationships to reduce cybersecurity risks and ensure that relevant security requirements are considered during selection, contracting, and ongoing monitoring. As part of this, Glesys shall, where relevant and to the extent applicable, impose on its suppliers cybersecurity obligations that correspond to those assumed by Glesys under this Information Security Annex, as applicable, and in accordance with the Cyber Security Rules. For the avoidance of doubt, nothing in this section shall limit Glesys’ discretion or right in the selection and engagement of subcontractors.

6.2 Glesys has established, implemented and complies with supplier relationship processes which governs the supply chain and Glesys’ relations with direct suppliers and service providers, including but not limited to:

a) due diligence on potential suppliers based on supplier categorisation based on criticality (e.g. critical, managed and non-critical), including identification of information security-critical suppliers, with defined oversight criteria and expectations for each category, to ensure sufficient cybersecurity practices, ability to meet sufficient cybersecurity standards, quality and resilience of ICT products and services, and ability to limit supplier lock-in;

b) for relevant procurements, assessing and as appropriate and necessary ensuring that security requirements may include multi-factor authentication, encryption, logging and monitoring, incident notification, data location and transfer restrictions, and assurance (e.g. ISO 27001 or SOC 2 certification); and

c) offboarding controls for security-critical supplier terminations, including secure return or destruction of information/data, access revocation and secure disposal expectations.

6.3 Prior to entering into any outsourcing or subcontracting arrangement that includes processing of information being outsourced, Glesys ensures that:

a) the information to be outsourced has been classified in accordance with Glesys' information classification model;

b) designated information owners and system owners have been appointed for the relevant information processing; and

c) a risk assessment addressing the risks associated with the outsourcing has been carried out and any identified risks have been appropriately addressed.

6.4 Glesys maintains an updated registry of its direct suppliers and service providers including contact details.

6.5 Glesys shall continuously monitor and evaluate its suppliers' compliance with the cybersecurity requirements set out in the applicable agreement between Glesys and such supplier. Where Glesys identifies any material non-compliance or material cybersecurity risk originating from a subcontractor or sub-supplier, Glesys shall take appropriate measures to address such non-compliance or risk without undue delay.