Isms doc a15 1 information security policy for supplier relationships

Information Security Policy for Supplier Relationships

ISO/IEC 27001 Toolkit Version 7 ©CertiKit 2016

Information Security Policy for Supplier Relationships [Insert Classification]

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document This document describes how relationships with third party suppliers will be created and managed to ensure effective information security.

Areas of the standard addressed The following areas of the ISO/IEC 27001:2013 standard are addressed by this document: Annex A A.15 Supplier relationships A.15.1 Information security in supplier relationships A.15.2 Supplier service delivery management

General Guidance This is an important area which is increasing in focus with the growth of cloud computing. You need to make sure you understand what your suppliers are doing in terms of their information security.

You may have a large number of suppliers of varying types and the key to meeting the requirements of the standard in this area is to categorise them in the way described in this document. The highest degree of effort may then be used appropriately in managing the suppliers that are strategic to the organization rather than trying to treat them all equally.

Ensure you keep minutes of all supplier meetings and that supplier records are kept up to date with contact details and references to contractual documentation.

Review Frequency We would recommend that this document is reviewed annually.

Toolkit Version Number ISO/IEC 27001 Toolkit Version 7 ŠCertiKit 2016.

Version 1

Page 1 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.

To update this field (and any others that may exist in this document): 1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly.

Further detail on the above procedure can be found in the Toolkit Completion Instructions within the Project Resources folder.

Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a trading name of Public I.T. Limited, a company registered in England and Wales with company number 6432088 and registered office at 5 Falcons Rise, Belper, Derbyshire, DE56 0QN.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third party copyright included in this document.

Version 1

Page 2 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Version 1

Page 3 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

[Replace with your logo]

Information Security Policy for Supplier Relationships

Document Classification: Document Ref. Version: Dated: Document Author: Document Owner:

Version 1

Page 4 of 11

[Insert Classification] ISMS-DOC-A15-1 1 [Insert date]

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

Revision History Version Date

Revision Author

Summary of Changes

Distribution Name

Title

Approval Name

Version 1

Position

Signature

Page 5 of 11

Date

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

Contents 1

INTRODUCTION ....................................................................................................................................... 7

2

INFORMATION SECURITY POLICY FOR SUPPLIER RELATIONSHIPS ................................... 8 2.1 GENERAL PROVISIONS .............................................................................................................................. 8 2.2 DUE DILIGENCE ........................................................................................................................................ 8 2.3 ADDRESSING SECURITY WITHIN SUPPLIER AGREEMENTS ........................................................................ 9 2.4 EVALUATION OF EXISTING SUPPLIERS ...................................................................................................... 9 2.5 MONITORING AND REVIEW OF SUPPLIER SERVICES .................................................................................. 9 2.6 MANAGING CHANGES TO SUPPLIER SERVICES ........................................................................................ 10 2.6.1 Changes Within Contract .............................................................................................................. 10 2.6.2 Contractual Disputes .................................................................................................................... 10 2.6.3 End of Contract............................................................................................................................. 11

List of Tables TABLE 1 - MEETING FREQUENCIES BY SUPPLIER CATEGORY .............................................................................. 10

Version 1

Page 6 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

1 Introduction [Organization Name] and its core business exists in a wider in which effective relationships with suppliers are critical to However, recent information security breaches have shown party supplier can represent a significant weakness in information assets.

economic environment its continued success. that sometimes a third the defences of our

In is very important therefore that our relationships with suppliers are based on a clear understanding of our expectations and requirements in the area of information security. These requirements must be documented and agreed in a way that leaves no doubt about the importance we place on the maintenance of effective controls to reduce risk.

It is up to [Organization Name] to demonstrate to our stakeholders that the choices we make regarding suppliers are done with due diligence and that the ongoing monitoring and review of the service supplied is performed in an effective way.

The purpose of this document is to set out the organization’s information security policy in the area of supplier relationships.

The following documents are relevant to this policy:   

Supplier Information Security Agreement Supplier Information Security Evaluation Process Supplier Due Diligence Assessment Procedure

Version 1

Page 7 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

2 Information Security Policy for Supplier Relationships 2.1

General Provisions

In general, information security requirements will vary according to the type of contractual relationship that exists with each supplier and the goods or services delivered.

However the following will generally apply.        

  

The information security requirements and controls should be formally documented in a contractual agreement which may be part of, or an addendum to, the main commercial contract Separate Non-Disclosure Agreements should be used where a more specific level of control over confidentiality is required Appropriate due diligence must be exercised in the selection and approval of new suppliers before contracts are agreed The information security provisions in place at existing suppliers (where due diligence was not undertaken as part of initial selection) must be clearly understood and improved where necessary Remote access by suppliers must be via approved methods that comply with our information security policies Access to [Organization Name] information should be limited where possible according to clear business need Basic information security principles such as least privilege, separation of duties and defence in depth should be applied The supplier will be expected to exercise adequate control over the information security policies and procedures used within sub-contractors who play a part in the supply chain of delivery of goods or services to [Organization Name] [Organization Name] will have the right to audit the information security practices of the supplier and, where appropriate, sub-contractors Incident management and contingency arrangements should be put in place based on the results of a risk assessment Awareness training will be carried out by both parties to the agreement, based on the defined processes and procedures

The selection of required controls should be based upon a comprehensive risk assessment taking into account information security requirements, the product or service to be supplied, its criticality to the organization and the capabilities of the supplier.

2.2

Due Diligence

Before contracting with a supplier, it is incumbent upon [Organization Name] to exercise due diligence in reaching as full an understanding as possible of the information security approach and controls the company has in place. It is important

Version 1

Page 8 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

that the documented Supplier Due Diligence Assessment Procedure is followed so that all of the required information is collected and an informed assessment can be made.

This is particularly important where cloud computing services are involved, as legal considerations regarding the location and storage of personal data must be considered.

2.3

Addressing Security Within Supplier Agreements

Once a potential supplier has been positively assessed with due diligence the information security requirements of [Organization Name] must be reflected within the written contractual agreement entered into. This agreement should take into account the classification of any information that is to be processed by the supplier (including any required mapping between [Organization Name] classifications and those in use within the supplier), legal and regulatory requirements and any additional information security controls that are required.

A template [Organization Name] Supplier Information Security Agreement should be used as a starting point.

Appropriate legal advice must be obtained to ensure that contractual documentation is valid within the country or countries in which it is to be applied.

2.4

Evaluation of Existing Suppliers

For those suppliers that were not subject to an information security due diligence assessment prior to an agreement being made, an evaluation process should be undertaken in order to identify any required improvements. For details of this process see Supplier Information Security Evaluation Process.

2.5

Monitoring and Review of Supplier Services

In order to focus resources on the areas of greatest need, suppliers will be categorized based on an assessment of their value to the organization.

Each supplier will be placed into one of the following four categories: 1.

2.

3.

4.

Commodity Operational Tactical Strategic

The recommended frequency of supplier review meetings between [Organization Name] and each supplier will be determined by the supplier’s category according to the following table.

Version 1

Page 9 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

Supplier Category Commodity Operational Tactical Strategic

Recommended Meeting Frequency None On contract renewal Annually Monthly/Quarterly

Table 1 - Meeting frequencies by supplier category

Each supplier will have a designated contract manager within [Organization Name] who is responsible for arranging, chairing and documenting the meetings.

The performance of strategic suppliers will be monitored on a regular basis in line with the recommended meeting frequency. This will take the form of a combination of supplier-provided reports against the contract and internally-produced reports.

Where possible, a frequent cross-check will be made between the supplier reports and those created internally in order to make sure the two present a consistent picture of supplier performance. Both sets of reports will be reviewed at supplier meetings and any required actions agreed.

2.6

Managing Changes to Supplier Services

2.6.1

Changes Within Contract

Changes to services provided by suppliers will be subject to the [Organization Name] change management process. This process includes the requirement to assess any information security implications of changes so that the effectiveness of controls is maintained.

2.6.2

Contractual Disputes

In the event of a contractual dispute, the following initial guidelines should be followed:     

The Chief Financial Officer must be informed that a dispute exists The CFO will then decide on next steps, based on an assessment of the dispute Where applicable, legal advice should be obtained via the CFO All correspondence with the supplier in dispute must be in writing and with the approval of the CFO An assessment of the risk to the organization should be carried out prior to escalating any dispute, and contingency plans put in place

At all times the degree of risk to the business should be managed and if possible minimised.

Version 1

Page 10 of 11

[Insert date]

Information Security Policy for Supplier Relationships [Insert Classification]

2.6.3

End of Contract

The following process will be followed for scheduled end of contract, early end of contract or transfer of contract to another party:    

The end of contract will be requested in writing within the agreed terms Transfer to another party shall be planned as a project and appropriate change control procedures followed An assessment of the risk to the organization should be carried out prior to ending or transferring the contract, and contingency plans put in place Any budgetary implications shall be incorporated into the financial model

The various aspects of ending a contract should be carefully considered at initial contract negotiation time.

Version 1

Page 11 of 11

[Insert date]