Vendor Management Policy

2025.1

Reviewed: 9/27/2024
Updated: 9/27/2024

Purpose and Scope:

1. This policy defines the rules for relationships with IMPLAN's Information Technology (IT) vendors and partners.
2. This policy applies to all IT vendors and partners who have the ability to impact the confidentiality, integrity, and availability of IMPLAN's technology and sensitive information, or who are within the scope of IMPLAN's information security program.
3. This policy applies to all employees and contractors that are responsible for the management and oversight of IT vendors and partners of IMPLAN.

Background:

1. The overall security of IMPLAN is highly dependent on the security of its contractual relationships with its IT suppliers and partners. This policy defines requirements for effective management and oversight of such suppliers and partners from an information security perspective. The policy prescribes minimum standards a vendor must meet from an information security standpoint, including security clauses, risk assessments, service level agreements, and incident management.

Controls and Procedures

Vendor Management

1. IT vendors are prohibited from accessing IMPLAN's information security assets until a contract containing security controls is agreed to and signed by the appropriate parties.
2. All IT vendors must comply with the security policies defined and derived from the Information Security Policy.
3. All security incidents by IT vendors or partners must be documented in accordance with IMPLAN's Security Incident Response Policy and immediately forwarded to the Information Security Manager (ISM) as defined within the policy.
4. IMPLAN must adhere to the terms of all Service Level Agreements (SLAs) entered into with IT vendors. As terms are updated, and as new ones are entered into, IMPLAN must implement any changes or controls needed to ensure it remains in compliance.
5. Before entering into a contract and gaining access to IMPLAN's information systems, IT vendors must undergo a risk assessment.
   a. Security risks related to IT vendors and partners must be identified during the risk assessment process.
   b. The risk assessment must identify risks related to information and communication technology, as well as risks related to IT vendor supply chains, to include sub-suppliers.
6. IT vendors and partners must ensure that organizational records are protected, safeguarded, and disposed of securely. IMPLAN strictly adheres to all applicable legal, regulatory and contractual requirements regarding the collection, processing, and transmission of sensitive data such as Personally-Identifiable Information (PII).
7. IMPLAN may choose to audit IT vendors and partners to ensure compliance with applicable security policies, as well as legal, regulatory and contractual obligations.