Supplier Relationship Management Policy

1. Purpose

This policy makes sure that information security and privacy risks created by suppliers are identified, agreed in contracts, monitored for the length of the relationship and removed when the relationship ends. A supplier is a risk to the Organisation even when the supplier is trusted.

2. Scope

The policy covers every external party that provides goods, services, software, cloud services, outsourced processing or staff to the Organisation, or that can reach its information, systems or premises.

• In scope: IT and cloud providers, software vendors, consultants, contractors, outsourced support, data processors, facility and cleaning services with physical access, resellers and the suppliers of those suppliers (the ICT supply chain).
• Out of scope: customers acting as customers, regulators, and one-off purchases of low-risk goods that involve no information and no access, as set out in the tiering table.

3. Terms and Definitions

4. Roles and Responsibilities

5. Policy Statement

5.1 Classification and due diligence

1. Every supplier must be classified before engagement, using the tiers in the table, and recorded in the supplier register with owner, service, data accessed, contract dates and review date.
2. Due diligence before contract is in proportion to the tier and covers security controls, privacy practice, financial stability, ownership, sanctions screening, location, incident history and, for critical suppliers, continuity arrangements.
3. Procurement must not start work or payment for a supplier that has not completed the checks for its tier.

5.2 Contract requirements

Contracts and statements of work with Critical and High suppliers must contain, at least, the following clauses. Legal records any gap and the risk accepted.

• Scope of services, the information and systems the supplier may access, and the purpose for which they may use them.
• Confidentiality, return and secure deletion of information at the end, and proof of deletion.
• Security controls the supplier must keep, consistent with the Organisation's policies, including access control, encryption, logging, patching, vulnerability management, background checks for people with access and training.
• Personal data terms: processing only on instruction, sub-processor approval, assistance with data subject requests and with breach handling, and transfer limits, consistent with the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement] and applicable law in each jurisdiction where the Organisation operates (such as the EU General Data Protection Regulation).
• Incident notification to the Organisation within [24 hours] of detection, or earlier where the Organisation needs to report in [6 hours] under the CERT-In Directions of 28 April 2022 [confirm the current requirement], with cooperation in investigation.
• Right to audit or to receive independent assurance reports, and to carry out reasonable security testing with agreement.
• Sub-contractors only with consent, and with the same security terms flowed down.
• Service levels, continuity and recovery commitments, and exit assistance.
• Termination rights for security breach, and clear responsibility for costs of breach.

5.3 Supplier access

• Supplier access to systems and data is granted under the Access Control Policy: least privilege, named individuals, multi-factor authentication, time-limited accounts, access only through approved gateways and logging of activity.
• Access is requested by the supplier relationship owner, approved by the system owner, and reviewed [quarterly]. It is removed within [1 working day] of contract end or when the person leaves the supplier's team.
• Supplier staff with access to Confidential data must be covered by background verification at the supplier, as the contract states, and must sign or be bound to the Organisation's confidentiality terms.
• Information shared with suppliers is limited to what is needed and is classified and labelled under the Information Classification and Handling Policy.

5.4 Monitoring and review

• The supplier relationship owner reviews performance against service levels, incidents, changes of ownership or location, sub-contractors and security evidence at the frequency set by tier.
• The information security manager reviews assurance evidence, such as audit reports, penetration test summaries and certification scope, and follows up gaps with the supplier within an agreed time.
• A supplier with repeated failures, a serious incident or a significant unresolved finding is placed on a watch list, with an improvement plan; failure to improve leads to replacement.
• Changes by the supplier that affect security, such as moving data to another country or changing a sub-processor, must be notified and reassessed before they apply.

5.5 Supply chain risk

• For Critical services, the supplier relationship owner must understand the main sub-contractors and the software components used, and ask the supplier for a software bill of materials or equivalent where the supplier writes code for the Organisation.
• Concentration risk, where one supplier supports several critical services, is reviewed yearly and noted in the risk register. Alternative suppliers or exit routes are identified for Critical suppliers.

5.6 Offboarding

1. NoticeGive or receive notice and activate the exit plan.
2. Return and deleteRetrieve information, remove access, collect assets and keys, and get written proof of deletion within [30 days].
3. CloseUpdate the register, close accounts and review lessons learned.

5.7 Supplier incidents

The supplier must report incidents as the contract states. The Organisation handles the incident under the Information Security Incident Management Policy, including notifying customers and authorities where needed, and records the supplier's root cause and corrective actions.

6. Compliance and Monitoring

Detailed steps and forms are in the Supplier Relationship Management Procedure.

7. Measures

8. Records and Evidence

• Supplier register, assessments, contracts and review notes, kept for the contract term plus [6 years].
• Supplier access approvals and reviews, kept [3 years].
• Incident and performance records, kept [3 years].

Annexure A: Supplier security assessment

Annexure B: Supplier register

9. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

10. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

11. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Supplier Relationship Management Procedure
• Cloud Computing Security Policy and Procedure
• Data Protection and Privacy Policy
• Information Classification and Handling Policy
• Access Control Policy
• Information Security Incident Management Policy
• Supplier Management Procedure