As government organisations increasingly rely on third-party vendors and service providers, supply chains have become a growing source of cybersecurity risk. To help organisations address these challenges, LAC4 developed the Standardised Secure Procurement Practices and Cybersecure Supply Chain Guidelines for the LAC Region. 

During the seminar, participants explored key topics of the guidelines, including: 

• Embedding cybersecurity into procurement: organisations need to understand what they are buying, how products and services are developed and delivered, and who can access their systems.  
• Growing supply-chain risks: cyberattacks increasingly target suppliers, software components and third-party processes. Yet, 76% of organisations lack dedicated supply-chain cybersecurity roles, and only 37% assess supplier risk, highlighting the need for stronger risk management.  
• A practical, risk-based framework: the guidelines were developed through a five-step process, resulting in 63 practical security questions aligned with criticality levels and international standards throughout the procurement lifecycle.  
• Addressing regional gaps: the guidelines identify common challenges, including the lack of standard security clauses, SBOM requirements, vulnerability disclosure processes, fourth-party risk management and clear incident notification requirements.  
• Practical implementation: the accompanying tool provides a five-step process to assess suppliers, verify evidence, incorporate security requirements into contracts and evaluate compliance according to different risk levels.  

Read the full Guidelines here: https://www.eucybernet.eu/materials/#information-security-standards Guidelines are available to download here in English (toolkit) and in Spanish (toolkit) 

The seminar was led by EU CyberNet Expert Pool experts and guidelines’ authors Predrag Tasevski and Florian Göhler. 

LAC4 remains committed to supporting its members in strengthening their cybersecurity capabilities and resilience. The seminar was specifically designed for cybersecurity stakeholders, decision-makers and policymakers from LAC4 member countries, including Antigua and Barbuda, Bahamas, Belize, Chile, Colombia, Costa Rica, Ecuador, El Salvador, Estonia, Guatemala, Guyana, Honduras, Suriname, Mexico, the Netherlands, Panama, the Dominican Republic, Uruguay and Trinidad and Tobago.