Supplier Onboarding and Review Procedure

Purpose

This Procedure describes how a new Supplier is assessed and contracted, how its access is controlled, and how the relationship is reviewed and ended, so that supply chain risk stays within what the Supplier Security Policy allows.

Scope

It applies to every Supplier that provides services, software, or equipment to Tidewell IT, or that handles our information or our customers' information.

Roles

• Supplier Manager: owns this Procedure and keeps the Suppliers register.
• Relationship Owner: the person who uses the Supplier and answers for the relationship.
• Data Protection Officer: assesses suppliers that handle personal data and signs off the data processing agreement.
• ISMS Manager: advises on the security questionnaire and the certificates.
• Management Board: approves a Critical Supplier.

Procedure

Request and classify

1. The Relationship Owner sends a request with the business reason to the Supplier Manager.
2. The Supplier Manager classifies the Supplier by Criticality: Critical, Important, or Low risk. The class depends on the information it will handle and the services that rely on it.

Due diligence and contract

1. The Supplier completes a security questionnaire. The ISMS Manager reviews it with the certificates and audit reports the Supplier can show.
2. The Supplier Manager makes a financial check that fits the class.
3. When personal data is involved, a data processing agreement is signed. It requires breach notification to Tidewell IT within 24 hours and keeps the data in the EEA.
4. No Supplier gets access before due diligence is finished and the contract is signed.
5. The Supplier Manager enters the Supplier in the Suppliers register with its class, contract dates, and Relationship Owner.

Access

1. Access for the Supplier is requested through the Access Request and Review Procedure, limited to what the service needs, and reviewed in the quarterly access review.

Review

1. Critical and Important Suppliers are reviewed every year, and Low risk Suppliers every two years.
2. The review checks service levels, incidents, changes to the service, certificates, and the contract terms. The result is recorded in the register.
3. Issues become Tasks for the Relationship Owner. A serious issue is reported to the ISMS Manager.

Offboarding

1. When the relationship ends, the Relationship Owner withdraws access and the Supplier returns or deletes our data. The Supplier confirms this in writing.
2. The Supplier Manager marks the Supplier as ended in the register and keeps the record.

Records

• The request, the classification, the questionnaire, and the checks.
• The signed contract and the data processing agreement.
• The review results and the written confirmation of deletion.

Related documents

• Supplier Security Policy
• Personal Data Protection Policy
• Access Request and Review Procedure

Review

The Supplier Manager reviews this Procedure at least once a year and after a significant change.