Siemens has established binding cybersecurity requirements, primarily for suppliers of security-critical components such as software, processors and electronic components for certain types of control units
New Siemens suppliers are required to comply with minimum binding cybersecurity requirements, introduced step-by-step starting on 15 February 2019, and anchored in a separate, binding clause in all new contracts. The existing suppliers who do not yet comply with the requirements need to implement them gradually.
The goal is to better protect the digital supply chain against hacker attacks.
In this regards, Siemens is following the course laid down by the Charter of Trust for cybersecurity. The requirements have stipulated that the suppliers must integrate special standards, processes and methods into their products and services.
Siemens stressed that in the future, suppliers themselves need to perform security reviews, conduct tests and take corrective action on a regular basis. The company is making these requirements mandatory for its own activities as well.
“This step will enable us to reduce the risk of security incidents along the entire value chain in a holistic manner and offer our customers greater cybersecurity,” said Roland Busch, chief operating officer and chief technology officer of Siemens and member of the company’s Managing Board.
“If all our partner companies put their global weight behind these measures and implement them together with their suppliers, we can generate tremendous impact and make the digital world more secure,” Busch added.
Siemens has further strengthened its internal capacities for repelling hacker attacks and restructured its cyber organisation. It aims to investigate, analyse and repel hacker attacks, as well as develop new cybersecurity services, aiming to react to attacks with greater speed and flexibility.
