Supplier Relationship Management Procedure

1. Purpose

This procedure sets out how the Organisation brings a supplier into its operations, keeps that supplier under control while it works, and releases it safely when the relationship ends. It turns the commitments of the Supplier Relationship Management Policy into steps that procurement, business owners, legal and information security can follow and that an auditor can verify.

• Make sure every supplier that touches Organisation information, systems or customer-facing platforms is known, assessed and contracted before work starts.
• Apply security requirements in proportion to the risk the supplier represents, not the size of the contract.
• Keep evidence of due diligence, contract terms, performance and security reviews for the whole life of the relationship.

2. Scope

The procedure applies to every external party that supplies goods, services, software, infrastructure, staff or advice to the Organisation, including the Organisation's own sub-contractors and the sub-contractors those suppliers use.

• In scope: cloud and hosting providers, software and platform vendors, managed service providers, consultants, contractors and temporary staff agencies, outsourced developers, data processors, couriers and records storage providers, facilities and cleaning contractors with physical access, and service arrangements between internal departments.
• Out of scope: statutory bodies and regulators, customers (covered by customer contracts), and one-off purchases of goods that carry no information, access or service dependency, such as stationery.
• Applies to: all employees who request, approve, manage or pay for a supplier, and to every supplier personnel working for the Organisation.

3. Terms and Definitions

4. Roles and Responsibilities

5. Business Rationale and Risk Assessment

No supplier may be engaged until the business has shown why it is needed and the risk of using it has been rated. The same assessment is repeated when the scope of work, the data shared or the supplier's ownership changes materially.

5.1 Business case

The supplier owner records the need before any commercial discussion begins. The record is short but must be specific enough for a reviewer to challenge.

• The business problem, the service or product required and the expected start date.
• Why the work cannot be done in-house and whether an approved supplier already offers it.
• The information and systems the supplier will see or use, with the highest classification involved, using the Information Classification and Handling Policy.
• Estimated annual value, term, and the cost of switching away if the supplier fails.
• Names of at least [three] candidate suppliers compared, or a written reason for a single-source choice approved by the Head of Procurement.

5.2 Supplier tiering

The information security team assigns a tier using the criteria below. The highest rating on any one criterion sets the tier.

5.3 Risk assessment

1. CollectThe supplier owner sends the supplier risk assessment form (Annexure A) and a security questionnaire to the supplier. Target: within [3 working days] of the business case being approved.
2. VerifyInformation security checks the answers against evidence such as independent audit reports, certificates, penetration test summaries, insurance and business continuity arrangements. Target: [10 working days] for High and Critical, [5] for others.
3. RateInformation security scores likelihood and impact using the Risk Management Policy method, records residual risk and the tier, and lists required security measures.
4. DecideThe approver in the tier table accepts, accepts with conditions, or rejects. Conditions become contract clauses or onboarding tasks with owners and dates.
5. RegisterProcurement enters the supplier in the supplier register with tier, owner, contract end date and next review date before the first purchase order is raised.

6. Contracts, Service Level Agreements and Non-Disclosure Agreements

Work must not begin, and no information may be shared, until a signed contract and a signed NDA are in place. A verbal agreement, a purchase order alone or an unsigned draft is not sufficient.

6.1 Contract requirements

• Legal and compliance prepares the contract from the Organisation's standard template; supplier paper is accepted only after review and with the mandatory security clauses added.
• Contract owner, signatory and approval limits follow the delegation of authority; the signed copy is stored in the document management system and linked to the supplier register.
• Contracts for Critical and High suppliers are renewed for no more than [3 years] at a time and are never allowed to roll over automatically without a review.
• Where the supplier processes personal data, a data processing addendum must be signed that follows the Data Protection and Privacy Procedure.

6.2 Service level agreements

Every supplier delivering an ongoing service must have measurable commitments. Sample values are shown for the adopter to calibrate.

6.3 Non-disclosure agreements

• A mutual or one-way NDA is signed before any confidential information, including pricing and architecture, is shared in a tender or proof of concept.
• The NDA must define confidential information, permitted purposes, the personnel who may see it, return or destruction on request, and a duration of at least [5 years] after the end of the relationship, with trade secrets protected for as long as they remain secret.
• Individual supplier staff who get access to Restricted information sign personal confidentiality undertakings or are covered by named clauses in their employer's contract.
• NDAs are logged in the supplier register with signature date and expiry, and reviewed with the contract.

7. Risk Assessment and Security Measures

The security measures applied to a supplier depend on its tier. The table is the minimum; information security may add controls where the assessment shows a specific risk.

7.1 Service level agreements with other departments

Where one internal department provides a service another depends on, such as IT providing hosting to a business unit, an internal service level agreement is agreed in the same format as an external one. It records the services, hours, availability and response targets, security responsibilities, escalation contacts and a review frequency of [12 months]. Internal arrangements are exempt from contract law steps but not from risk assessment: the receiving department records the dependency and the Head of Information Security reviews any gap.

8. Sub-contracting by Vendor

A supplier may sub-contract part of its service only with the Organisation's prior written consent, which may be given in the contract for named sub-contractors or requested case by case. The supplier stays fully liable for the acts of its sub-contractors.

• The supplier must disclose each sub-contractor that will handle Organisation information, its location and the work it performs, and update the list within [10 working days] of any change.
• Security, confidentiality and audit terms equivalent to those in the main contract must be flowed down in writing; the Organisation may ask to see the relevant clauses.
• The Organisation may object to a new sub-contractor on reasonable security, legal or location grounds within [30 days] of notice and, if unresolved, terminate the affected service without penalty.
• Sub-contractors of Critical and High suppliers are listed in the supplier register and are within the scope of supplier reviews.

8.1 Physical security of desktops and laptops for third-party suppliers

Where supplier staff work on devices that hold or reach Organisation information, the supplier must apply the following, and the supplier owner verifies it at onboarding and at each review.

• Devices are owned or managed by the supplier, with full-disk encryption, endpoint protection, automatic screen lock after [5 minutes] and supported, patched operating systems.
• Devices are used only in the supplier's secured premises or in a home setting that meets the Mobile Device and Teleworking Policy; they are never left unattended in vehicles or public places.
• Organisation data is not copied to removable media or personal cloud storage; printing is disabled unless approved.
• Loss or theft is reported to the supplier owner within [4 hours]; the supplier proves remote wipe or encryption status within [24 hours].
• Where the work is done on Organisation-issued devices, the Mobile Device Management Procedure applies and the devices are returned and wiped on exit.

9. Supplier Relationship Management

A named supplier owner manages each relationship from onboarding to exit. The activities below are the minimum.

1. OnboardWithin [5 working days] of signature, create supplier accounts through the User Access Management Procedure with least privilege and an end date matching the contract; brief supplier staff on the Acceptable Usage Policy.
2. OperateHold a service meeting at the frequency in the review schedule, record actions and track them to closure in the ticketing tool.
3. EscalateRaise breaches of SLA or security terms in writing, copy the supplier executive sponsor after [two] repeated misses, and notify Procurement.
4. ReassessRepeat the risk assessment at renewal, and on any material change, incident or reported weakness.
5. ExitFollow the exit plan: revoke accounts within [1 working day] of the end date, retrieve assets, obtain written confirmation of data return and deletion, and update the register.

9.1 Termination and exit

• Exit plans for Critical and High suppliers are written at contract signature and tested by walkthrough every [12 months].
• On termination, access is removed, shared secrets and keys that the supplier knew are rotated, and a certificate of deletion is obtained within [30 days] and filed.
• A supplier terminated for cause is reviewed by information security for any residual exposure, and lessons are recorded.

10. Monitoring and Review of Third-Party Services

Supplier performance and security posture are reviewed on a fixed schedule. Findings are recorded and tracked; a supplier that cannot show improvement is moved to a watch list and considered for replacement.

• Service reports are compared with SLA commitments and credits claimed where targets are missed.
• User access held by supplier staff is recertified by the supplier owner at least every [quarter] and removed when staff leave the engagement.
• Supplier security incidents, regulatory actions, financial difficulty or ownership changes found through monitoring trigger an out-of-cycle review within [10 working days].

11. Managing Changes to Partner Services

Changes by the supplier, or requested by the Organisation, that could affect security, availability or compliance are handled as controlled changes.

• The contract requires suppliers to give at least [30 days] notice of changes to service architecture, hosting location, sub-contractors, ownership or security controls, and [5 working days] for emergency changes with an immediate explanation.
• The supplier owner raises a change under the Change Management Procedure, and information security reviews whether the tier, risk rating or contract clauses must change.
• Contract variations are signed before the change goes live; verbal agreements to vary scope are not binding.
• The supplier register is updated after every approved change, and the next review date is brought forward where residual risk has increased.

12. Supplier Management Standard

This section is the standard that each supplier relationship is measured against. It is used by assessors during selection and by auditors during review.

• Every supplier is registered, tiered, owned and contracted before work starts.
• Every supplier with access to information is bound by an NDA and security clauses matching its tier.
• Every supplier is reviewed on its tier schedule and every review leaves a dated record.
• No supplier retains Organisation data or access after the relationship ends.

12.1 Considerations for contract

13. Measures

14. Records and Evidence

Annexure A: Supplier risk assessment form

Annexure B: Supplier register

15. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

16. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

17. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Supplier Relationship Management Policy
• Supplier Management Procedure
• Risk Management Policy
• Information Classification and Handling Policy
• Cloud Computing Security Policy and Procedure
• Incident Management Procedure
• Service Level Management Procedure
• Data Protection and Privacy Procedure