Policy template

Supplier Security Policy template

This policy exists to ensure suppliers that access, process or support company information maintain an appropriate level of security. It applies to all suppliers, service providers, cloud providers and subcontractors.

Create this policy

What the policy contains

Selection
Contracts
Monitoring

Who is responsible

Procurement / contract owners
Information Security Manager
Legal

What you decide

How critical suppliers are assessedSecurity questionnaire · Certifications (ISO 27001, SOC 2…) · On-site or remote audit
Review of critical suppliersQuarterly · Every 6 months · Yearly

References covered

ISO/IEC 27001 Annex A: control 5.19
ISO/IEC 27001 Annex A: control 5.20
ISO/IEC 27001 Annex A: control 5.21
ISO/IEC 27001 Annex A: control 5.22
ISO/IEC 27001 Annex A: control 5.23
GDPR: Art. 28 processor
NIS2: Art. 21(2)(d) supply chain security

Other policy templates

Data Protection (Privacy) Policy
Data Retention Policy
Clear Desk & Clear Screen Policy
Cryptography & Encryption Policy
Logging & Monitoring Policy
Vulnerability Management Policy