๐๐๐ง๐๐จ๐ซ ๐๐๐ง๐๐ ๐๐ฆ๐๐ง๐ญ ๐๐จ๐ฅ๐ข๐๐ฒ
- 2. www.infosectrain.com | www.azpirantz.com Revision History Version Author Description of Changes Release Date 1 XYZ Information Security Manager XYZ 29/01/2025 : : : : Version Author Reviewed by Approved by 1 XYZ Information Security Manager XYZ CTO (Chief Technology Of๏ฌcer) Board of Directors : : : :
- 3. www.infosectrain.com | www.azpirantz.com Purpose Scope Roles and Responsibilities Framework Vendor selection criteria Onboarding Vendor Categorization Offboarding and Termination Compliance and Enforcement Policy review and maintenance 04 05 06 07 07 07 08 08 09 10 Table of Contents
- 4. 04 www.infosectrain.com | www.azpirantz.com Purpose The purpose of this Vendor Management Policy is to establish a framework for selecting, onboarding, monitoring, and terminating relationships with vendors to minimize risks, ensure compliance with applicable regulations, and safeguard organizational resources and data.
- 5. 05 www.infosectrain.com | www.azpirantz.com Scope This policy applies to all employees, departments, and business units of XYZ company that engage with vendors, suppliers, contractors, service providers, and third-party organizations. It covers all vendor interactions, including procurement, onboarding, compliance, and termination.
- 6. 06 www.infosectrain.com | www.azpirantz.com Roles and Responsibilities TPRM shall be responsible for maintaining the vendor inventory. Responsible for conducting the security assessments before onboarding any vendor and monitoring periodic review of the vendors. TPRM shall be responsible for the development and update of the vendor management framework. Business unit heads shall be responsible for the vendor requirements and approval of vendor selection as well as their onboarding. Vendor Manger shall oversee the entire vendor lifecycle and manage the vendor system access. 3.1 TPRM or Third Party Risk Management 3.2 Business Unit Heads 3.3 Vendor Manager
- 7. 07 www.infosectrain.com | www.azpirantz.com Framework 4.1 Vendor Selection Criteria Criteria shall be based on business requirements and needs, compliance with regulatory standards and certi๏ฌcations and industry reputation. Conduct a comprehensive vendor risk assessment, including background veri๏ฌcation, review of past performance and legal history. 4.2 Onboarding Collect necessary documentation including business registration, and regulatory compliance certi๏ฌcations (ISO 27001, SOC 2, GDPR compliance). Formalize contractual agreements like Non-Disclosure Agreements (NDAs), Service-Level Agreements (SLAs).
- 8. 08 4.3 Vendor Categorization Vendors shall be categorized into three levels High: Vendors shall be categorized as high, if they can cause signi๏ฌcant ๏ฌnancial loss or can lead to business disruptions beyond 24 hours. Examples: cloud service providers, payment processors, data centres. Medium: Vendors shall be categorized as medium, if they support business functions but do not directly impact core operations and if the disruption time is not more than 24 hours. Examples: IT support providers, HR outsourcing ๏ฌrms, marketing agencies. Low: Vendors shall be categorized as low, if they have minimal or no access to sensitive data and provide non-critical services with low business impact. Examples: of๏ฌce supply vendors, catering services, cleaning companies. 4.4 Offboarding and Termination Revoke all system and network access granted to the vendor and retrieve company-issued assets Verify the destruction of organizational data and update vendor records/inventory to re๏ฌect termination status. Conduct a ๏ฌnal compliance review and risk assessment, if applicable to the vendor.
- 9. 09 www.infosectrain.com | www.azpirantz.com Compliance and Enforcement Vendors are required to comply with contractual and policy requirements; non-compliance may lead to contract termination and legal action.
- 10. 10 www.infosectrain.com | www.azpirantz.com Policy Review and Maintenance This policy shall be reviewed at least annually or in response to signi๏ฌcant regulatory changes and any modi๏ฌcations or updates must be approved by senior management. Authored by: Dinesh