Example of Information security policy for supplier relationships

Uncategorized 8 Minutes

1 Policy Statement

All contracts with external suppliers for providing services to XXX  shall be monitored and reviewed to ensure that information security requirements are being satisfied. Contracts shall include appropriate provisions to ensure the continued security of information and systems in the event that a contract is terminated or transferred to another party. Outsourcing and Supplier Policy sets out the conditions that are required to maintain the security of the information and systems when third parties other than the organization’s own staff are involved in their operation. This may occur in at least three distinct circumstances:

  1. When third parties (for example, contractors) are involved in the design, development, or operation of information systems for the organization. There may be many reasons for this to happen, including developing and installing bespoke software, third party maintenance or operation of systems, to full outsourcing of an IT facility;
  2. When access to the organization’s information systems is granted from remote locations where computer and network facilities may not be under the control of the organization;
  3. When users who are not members of the organization are given access to information or information systems.

Each of these circumstances involves a risk to the organization’s information, which should be assessed before the third party is granted access. Such access must be subject to appropriate conditions and controls to ensure that risks can be managed.

2 Purpose

The Outsourcing and Supplier Policy sets out the conditions that are required to maintain the security of the organization’s information and systems when third parties are involved in their operation.

3 Policy axioms

  • The commercial benefits of outsourcing non-core business functions must be balanced against the commercial and information security risks.
  • The risks associated with outsourcing must be managed through the imposition of suitable controls, comprising a combination of legal, physical, logical, procedural, and managerial controls

4 Scope

4.1 Employees

This policy applies to all Suppliers, Contractors, and Third Parties who provide IT-related services .

4.2 IT Assets

This policy is applicable for all network systems, services and information systems.

4.3 Documentation

The documentation shall consist of Outsourcing and Supplier Policy, and related procedures & guidelines. The Outsourcing and Supplier Policy document and all other referenced documents shall be controlled. Version control shall be to preserve the latest release and the previous version of any document. However, the previous version of the documents shall be retained only for a period of two years for legal and knowledge preservation purposes.

4.4 Records

Records being generated as part of the Outsourcing and Supplier Policy shall be retained for a period of two years. Records shall be in hard copy or electronic media. The records shall be owned by the respective system administrators and shall be audited once a year.

4.4 Distribution and Maintenance

The Outsourcing and Supplier Policy document shall be made available to all the employees covered in the scope. All the changes and new releases of this document shall be made available to the persons concerned. The maintenance responsibility of the document shall be with the CISO and system administrators.

5 Privacy

The Outsourcing and Supplier Policy document shall be considered as “confidential” and shall be made available to the concerned persons with proper access control. Subsequent changes and versions of this document shall be controlled.

6 Responsibility

The Outsourcing and Supplier Policy shall be implemented by the CISO / designated personnel.

7 Policy

7.1 Choosing an outsourcer

Criteria for selecting an outsourcer shall be defined and documented, taking into account the:

  • company’s reputation and history;
  • quality of services provided to other customers;
  • number and competence of staff and managers;
  • financial stability of the company and commercial record;
  • retention rates of the company’s employees;
  • Quality assurance and security management standards currently followed by the company (e.g. certified compliance with ISO 9000 and ISO/IEC 27001).

Further information security criteria may be defined as the result of the risk assessment.

7.2 Assessing outsourcing risks

Management shall nominate a suitable owner for each business function/process outsourced. The owner, with help from the local Information Risk Management Team, shall assess the risks before the function/process is outsourced, using XXX’s standard risk assessment processes. In relation to outsourcing, specifically, the risk assessment shall take due account of the:

  • nature of logical and physical access to information assets and facilities required by the outsourcer to fulfill the contract;
  • sensitivity, volume, and value of any information assets involved;
  • commercial risks such as the possibility of the outsourcer’s business failing completely, or of them failing to meet agreed service levels or providing services to XXX’s competitors where this might create conflicts of interest; and
  • security and commercial controls are known to be currently employed by XXX and/or by the outsourcer.

The result of the risk assessment shall be presented to management for approval prior to signing the outsourcing contract. Management shall decide if XXX will benefit overall by outsourcing the function to the outsourcer, taking into account both the commercial and information security aspects. If the risks involved are high and the commercial benefits are marginal (e.g. if the controls necessary to manage the risks are too costly), the function shall not be outsourced.

7.3 Contracts and confidentiality agreements

A formal contract between XXX and the outsourcer shall exist to protect both parties. The contract shall clearly define the types of information exchanged and the purpose for so doing.  If the information being exchanged is sensitive, a binding confidentiality agreement shall be in place between XXX and the outsourcer, whether as part of the outsource contract itself or a separate non-disclosure agreement (which may be required before the main contract is negotiated). Information shall be classified and controlled in accordance with XXX policy. Any information received by XXX from the outsourcer who is bound by the contract or confidentiality agreement shall be protected by appropriate classification and labeling.  Upon termination of the contract, the confidentiality arrangements shall be revisited to determine whether confidentiality has to be extended beyond the tenure of the contract. All contracts shall be submitted to the Legal for accurate content, language, and presentation.
The contract shall clearly define each party’s responsibilities toward the other by defining the parties to the contract, effective date, functions or services being provided (e.g. defined service levels), liabilities, limitations on use of sub-contractors, and other commercial/legal matters normal to any contract. Depending on the results of the risk assessment, various additional controls should be embedded or referenced within the contract, such as:

  • Legal, regulatory, and other third party obligations such as data protection/privacy laws, money laundering, etc.;
  • Information security obligations and controls such as:
    • Information security policies, procedures, standards, and guidelines, normally within the context of an Information Security Management System such as that defined in ISO/IEC 27001;
    • Background checks on employees or third parties working on the contract;
    • Access controls to restrict unauthorized disclosure, modification, or destruction of information, including physical and logical access controls, procedures for granting, reviewing, updating, and revoking access to systems, data, and facilities, etc.;
    • Information security incident management procedures including mandatory incident reporting;
    • Return or destruction of all information assets by the outsourcer after the completion of the outsourced activity or whenever the asset is no longer required to support the outsourced activity;
    • Copyright, patents, and similar protection for any intellectual property shared with the outsourcer or developed in the course of the contract;
    • Specification, design, development, testing, implementation, configuration, management, maintenance, support, and use of security controls within or associated with IT systems, plus source code escrow;
    • Anti-malware, anti-spam and similar controls;
    • IT change and configuration management, including vulnerability management, patching, and verification of system security controls prior to their connection to production networks;
  • The right of XXX to monitor all access to and use of facilities, networks, systems, etc., and to audit the outsourcer’s compliance with the contract, or to employ a mutually agreed independent third party auditor for this purpose;
  • Business continuity arrangements including crisis and incident management, resilience, backups, and IT Disaster Recovery.

Although outsourcers that are certified compliant with ISO/IEC 27001 can be presumed to have an effective Information Security Management System in place, it may still be necessary for XXX to verify security controls that are essential to address KDCC’s specific security requirements, typically by auditing them.

7.4 Hiring and training of employees

Outsource employees, contractors, and consultants working on behalf of XXX shall be subjected to background checks equivalent to those performed on XXX employees. Such screening shall take into consideration the level of trust and responsibility associated with the position and (where permitted by local laws):

  • Proof of the person’s identity (e.g. passport);
  • Proof of their academic qualifications (e.g. certificates);
  • Proof of their work experience (e.g. résumé/CV and references);
  • Criminal record check;
  • Credit check.

Companies providing contractors/consultants directly to XXX or to outsourcers used by XXX shall perform at least the same standard of background checks as those indicated above.  Suitable information security awareness, training, and education shall be provided to all employees and third parties working on the contract, clarifying their responsibilities relating to  XXX information security policies, standards, procedures, and guidelines (e.g. privacy policy, acceptable use policy, the procedure for reporting information security incidents, etc.) and all relevant obligations defined in the contract.

7.5 Access controls

In order to prevent unauthorized access to XXX’s information assets by the outsourcer or sub-contractors, suitable security controls are required as outlined in this section. The details depend on the nature of the information assets and the associated risks, implying the need to assess the risks and design suitable controls architecture. Technical access controls shall include:

  • User identification and authentication;
  • Authorization of access, generally through the assignment of users to defined user roles having appropriate logical access rights and controls;
  • Data encryption in accordance with XXX’s encryption policies and standards defining algorithms, key lengths, key management, and escrow, etc.
  • Accounting/audit logging of access checks, plus alarms/alerts for attempted access violations where applicable.

Procedural components of access controls shall be documented within procedures, guidelines, and related documents and incorporated into awareness, training, and educational activities. This includes:

  • Choice of strong passwords;
  • Determining and configuring appropriate logical access rights;
  • Reviewing and if necessary revising access controls to maintain compliance with requirements;

Physical access controls shall include:

  • Layered controls covering the perimeter and internal barriers;
  • Strongly-constructed facilities;
  • Suitable locks with key management procedures;
  • Access logging through the use of automated key cards, visitor registers, etc.;
  • Intruder alarms/alerts and response procedures;

If parts of XXX’s IT infrastructure are to be hosted at a third-party data center, the data center operator shall ensure that XXX’s assets are both physically and logically isolated from other systems. XXX shall ensure that all information assets handed over to the outsourcer during the course of the contract (plus any copies made thereafter, including backups and archives) are duly retrieved or destroyed at the appropriate point on or before termination of the contract. In the case of highly classified information assets, this normally requires the use of a schedule or register and a process whereby the outsourcer formally accepts accountability for the assets at the point of hand-over.

7.6 Security audits

If XXX has outsourced a business function to an outsourcer based at a different location, it shall audit the outsourcer’s physical premises periodically for compliance with XXX’s security policies, ensuring that it meets the requirements defined in the contract. The audit shall also take into consideration the service levels agreed in the contract, determining whether they have been met consistently and reviewing the controls necessary to correct any discrepancies. The frequency of audit shall be determined by management on advice from functions such as Internal Audit, Information Security Management, and Legal.

8 Enforcement

Any employee found to have violated this policy may be subjected to disciplinary action in line with the HR Policy.

Back to Home

If you need assistance or have any doubt and need to ask any questions contact me at preteshbiswas@gmail.com. You can also contribute to this discussion and I shall be happy to publish them. Your comments and suggestion are also welcome.

Published by Pretesh Biswas

Pretesh Biswas has wealth of qualifications and experience in providing results-oriented solutions for your system development, training or auditing needs. He has helped dozens of organizations in implementing effective management systems to a number of standards. He provide a unique blend of specialized knowledge, experience, tools and interactive skills to help you develop systems that not only get certified, but also contribute to the bottom line. He has taught literally hundreds of students over the past 5 years. He has experience in training at hundreds of organizations in several industry sectors. His training is unique in that which can be customized as to your management system and activities and deliver them at your facility. This greatly accelerates the learning curve and application of the knowledge acquired. He is now ex-Certification body lead auditor now working as consultancy auditor. He has performed hundreds of audits in several industry sectors. As consultancy auditor, he not just report findings, but provide value-added service in recommending appropriate solutions. Experience Consultancy: He has helped over 100 clients in a wide variety of industries achieve ISO 9001,14001,27001,20000, OHSAS 18001 and TS 16949 certification. Industries include automotive, metal stamping and screw machine, fabrication, machining, assembly, Forging electrostatic and chrome plating, heat-treating, coatings, glass, plastic and rubber products, electrical and electronic equipment, assemblies & components, batteries, computer hardware and software, printing, placement and Security help, warehousing and distribution, repair facilities, consumer credit counseling agencies, banks, call centers, etc. Training: He has delivered public and on-site quality management training to over 1000 students. Courses include ISO/TS -RAB approved Lead Auditor, Internal Auditing, Implementation, Documentation, as well as customized ISO/TS courses, PPAP, FMEA, APQP and Control Plans. Auditing: He has conducted over 100 third party registration and surveillance audits and dozens of gap, internal and pre-assessment audits to ISO/QS/TS Standards, in the manufacturing and service sectors. Other services: He has provided business planning, restructuring, asset management, systems and process streamlining services to a variety of manufacturing and service clients such as printing, plastics, automotive, transportation and custom brokerage, warehousing and distribution, electrical and electronics, trading, equipment leasing, etc. Education & professional certification: Pretesh Biswas has held IRCA certified Lead Auditor for ISO 9001,14001 and 27001. He holds a Bachelor of Engineering degree in Mechanical Engineering and is a MBA in Systems and Marketing. Prior to becoming a business consultant 6 years ago, he has worked in several portfolios such as Marketing, operations, production, Quality and customer care. He is also certified in Six Sigma Black belt .

Published

Leave a Reply