IPC-1792 Cybersecurity - Self-Assessment and Recordkeeping
IPC-1792 establishes the minimum security and system requirements that supply chain entities must maintain to implement incident notification in compliance with the standard. IPC-1792 requires participating stakeholders in the supply chain to meet the security requirements defined in the standard. These requirements vary depending on the products a stakeholder produces and the industry in which it operates.
For now, compliance is based on self-assessment: each stakeholder conducts its own security audit, documents the results and maintains the records internally. While the standard anticipates that cybersecurity auditors may eventually perform external evaluations, the current system relies solely on self-assessment.
The checklist includes all "shall" provisions from the IPC-1792 document related to operating cybersecurity infrastructure, maintaining operational best practices, rapid assessment and identification of attacks, and management of incidents and attack-vulnerable assets. It references the relevant sections of the standard and uses standardized terminology.
Requirements include items that can only be implemented after mutual agreement within the supply chain, as well as items that can be implemented independently.
As an implementation procedure, it is advisable for companies to initially implement only the items they can implement independently. In the second phase, they should implement the items that have been agreed upon with suppliers, based on customer requirements and their corresponding solutions.
In this sample checklist, the first phase is marked as a recommendation.