10. Supply Chain and Third-Party Risk Management

10.1 Supplier Identification

OpenRemote maintains an overview of suppliers and service providers that support its operations. These include cloud infrastructure providers, software platforms, and service partners (see chapter 16).

10.2 Third-Party Security Assessment

When selecting or reviewing suppliers, OpenRemote considers the security posture of the supplier and the potential risks associated with their services.

Where relevant, contractual agreements include provisions related to security and data protection.

10.3 Open Source Dependency Governance

OpenRemote actively manages dependencies on third-party open source components used in its software platform (see 5.5 SBOM Management).

Dependencies are monitored for security vulnerabilities and updated when necessary to maintain system security (see 6. Vulnerability Management and Coordinated Disclosure).