Mythos Hardening Control · MRIS 2.0 · Applies to TISAX®

MHC-14 Independent verification of supplier evidence

Prevents an AI-assisted, convincingly forged or embellished supplier attestation from being accepted as sufficient without detection.

At a glance

Operational benefit: prevents an AI-supported, convincingly forged or embellished supplier evidence item from being accepted as sufficient without detection.
Policy affected: the supplier management and procurement policy.
Dependencies: no precondition; implementable independently of MHC-15.
Effort drivers: the number of critical suppliers, contract terms (new contracts versus existing contracts).
Cost envelope (license/person-days, indicative order of magnitude without individual prices): SME — license low (no dedicated tool needed, occasional external audit services for the most critical suppliers), roughly 10–20 person-days · Midcap — license low to medium, roughly 20–45 person-days · Enterprise — license medium (third-party risk management tooling for a larger supplier base), roughly 45–100 person-days.
Primary metric: share of critical suppliers with an exercised, not merely contractually provided for, audit right within the current cycle.
Standards touched (no claim of fulfilment): DORA Art. 30(3); TISAX® ISA 2027 6.1.1, 6.1.3.

Control statement

Security evidence, certifications and self-declarations submitted by suppliers or cooperation partners do not replace the organization’s own review. For suppliers with access to protection-worthy information, an independent audit right — exercised directly or through a commissioned third party — is contractually anchored, at least for high or very high protection requirement, and is actually exercised within the agreed review cycle.

Purpose and threat relevance

Reviewing suppliers rests predominantly on documents submitted by the supplier itself. AI tools make convincingly forged or embellished reports and evidence easier to produce, without an independent counter-check being required — mere self-declaration or attestation suffices in the standard TISAX® wording. The protective objective is that a forged or embellished evidence item is not accepted as sufficient without detection.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

Effect across frameworks
Number	Title	Classification / Level
TISAX® ISA 2027 2 controls
6.1.1	Information security with contractors and partners	partially degraded
6.1.3	Responsibilities between external IT service providers and the organization	not affected

All 45 controls in the findings matrix

Maturity path

Initial: audit clause included in the contract template for new contracts.
Defined: audit clause renegotiated for all critical existing contracts; the review cycle scheduled and actually exercised at least once for the most critical suppliers.
Managed: audits are demonstrably carried out on the agreed cycle; results feed back into the supplier risk classification.

Measurement and audit evidence

Metric: share of critical suppliers with an audit actually carried out within the current cycle (target: 100% of suppliers classified as critical).
Evidence: contract clauses, audit/review reports with dates, escalation records where exercise of the audit was refused.
Verification logic (following ISO/IEC 27001, Clause 9): documented? — the clause in the contract; responsible? — procurement/supplier management; frequency? — per the agreed cycle, at least annually for critical suppliers; tolerance? — no critical supplier without an audit carried out within the current cycle.
Evidence mapping to the ISA catalogue: for control 6.1.1 the ISA catalogue names as example evidence, among others, "Template NDA with a contractor"; "Example of a signed NDA"; "Example of a risk assessment (Focus point: Information security aspects)"; "Viewing of audit reports"; "List of approved contractors" (further examples in the source catalogue, not listed in full here). For 6.1.3 the catalogue provides no example; here the MHC evidence above carries the full weight on its own.

Typical mistakes

The audit clause is in the contract but is never actually exercised — a pure formality.
All suppliers are treated the same, irrespective of the actual depth of their access to protection-worthy information.
A submitted certificate is uncritically accepted as a complete substitute for the organization’s own review.
Existing contracts without an audit clause are never renegotiated, on the reasoning that "new contracts are enough".

Delimitation and residual risk

Delimitation: concerns evidence verification in supplier management; the technical integration of external services itself is governed by MHC-13 where AI agents are involved.
Residual risk: even a completed audit is a sample at a point in time — a deterioration occurring after the audit remains undetected until the next cycle (see MHC-10 for the event-driven supplement).
TISAX® controls: 6.1.1, 6.1.3 (see Part I).
Framework: DORA Art. 30(3) (a sector-specific reference framework, financial sector) — submitted certifications "support but do not replace" the organization’s own review; an unrestricted audit/inspection right for critical functions.

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog