History

Purpose

This Policy makes sure that the suppliers we depend on protect our information and our customers' information as well as we do. Much of what we deliver rests on colocation, connectivity, software, and hardware that others provide.

Scope

This Policy covers every supplier that handles our information, connects to our systems, or supplies a service or product that our own services rely on, including cloud services and the wider ICT supply chain.

Policy statements

Classification by Criticality

1. Each supplier is classified as Critical, Important, or Low risk, based on the harm its failure or its breach would cause.
2. The Supplier Manager records the classification and a Relationship Owner in the Suppliers register.
3. The classification is reviewed when the supplier's role changes and after an incident at the supplier.

Due diligence

1. No supplier gets access to information or systems before due diligence is done and a contract is signed.
2. Due diligence covers a security questionnaire, certificates, and a financial check, in proportion to the Criticality.
3. Gaps found in due diligence are recorded. The Supplier Manager closes or accepts each gap before access is given.

Contract requirements

1. Contracts state the security requirements, the right to audit, and the duty to notify a breach to Tidewell IT within 24 hours.
2. A data processing agreement is signed for any personal data a supplier handles.
3. Subcontractors of a supplier meet the same security requirements, and the supplier answers for them.

Cloud services

1. Cloud services that hold our data or customer data store it in the EEA, and the data processing agreement says so.
2. We keep control of the encryption keys where the service allows it.

ICT supply chain

1. We ask suppliers who deliver ICT products and services how they manage their own suppliers, and we avoid single points of failure for Critical services.
2. Hardware and software are bought from authorised sources, and their origin is recorded in the asset inventory.

Roles and responsibilities

The Supplier Manager owns this Policy and the Suppliers register. Relationship Owners manage the day-to-day contact and prepare reviews. The Data Protection Officer checks the data processing agreements. The ISMS Manager advises on security requirements. The Management Board approves contracts with Critical suppliers.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. An exception to due diligence for a Critical supplier needs the approval of the Management Board.

Compliance and enforcement

A supplier that is found without due diligence or without a contract is suspended until both are in place. Breaches of this Policy lead to disciplinary measures under the HR process.

Related documents

• Supplier Onboarding and Review Procedure
• Personal Data Protection Policy
• Information Security Policy
• Risk Management Policy
• Access Request and Review Procedure

Review

The Supplier Manager reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.