1. Purpose
This policy defines the procedures, controls, and processes Howwe employs when working with third-party service providers. It ensures that all third-party relationships align with regulatory requirements, uphold data protection standards, and mitigate risks associated with outsourcing critical services.
2. Scope
This policy applies to all third-party service providers (suppliers) engaged by Howwe for any operational, technical, or administrative purpose. It includes procedures for:
Supplier Assessment and Approval: Evaluation of potential suppliers to ensure compliance and suitability.
Risk Management and Compliance: Identification and mitigation of risks related to supplier relationships.
Ongoing Oversight and Performance Monitoring: Continuous evaluation of supplier performance and compliance.
3. Supplier Risk Assessment
3.1 Regulatory Compliance
PII Handling: Suppliers processing Personally Identifiable Information (PII) must comply with GDPR, CCPA, and relevant local data protection laws, providing evidence of compliance (e.g., ISO certifications, SOC 2 reports).
Data Residency: Suppliers must meet data residency requirements as specified by regulations or customers.
3.2 Operational Risk
Criticality Assessment: Evaluate the supplier’s impact on Howwe’s business continuity by addressing key questions:
What happens if the supplier’s services are unavailable?
What dependencies exist on the supplier's uptime?
Who at Howwe needs access to the supplier’s systems?
Business Continuity Planning: Suppliers must provide disaster recovery and business continuity plans.
3.3 Security and Technical Risk
Data Security Standards: Suppliers must adhere to encryption, access control, and vulnerability management best practices.
Third-Party Risk Tools: Use questionnaires, audits, or certifications for comprehensive supplier evaluations.
3.4 Fourth-Party Risk Management
Suppliers must disclose critical dependencies (fourth-party providers) and their security practices.
Fourth-party compliance with Howwe’s security and data protection requirements must be demonstrated through certifications (e.g., ISO 27001, SOC 2).
4. Supplier Approval Process
4.1 Initial Assessment
Due Diligence: Evaluate suppliers based on regulatory compliance, financial stability, technical capabilities, and security posture.
Security Documentation: Require documentation such as:
ISO 27001/27701 certifications.
SOC 2/3 reports.
Data Protection Impact Assessments (DPIAs).
4.2 Approval Requirements
Suppliers must:
Obtain management approval.
Complete a formal risk assessment.
Secure explicit sign-off from the Chief Product Officer (CPO) for PII or critical service providers.
4.3 Contractual Agreements
Contracts must include:
Data protection clauses complying with GDPR, CCPA, and other regulations.
Service Level Agreements (SLAs) to define performance expectations.
Liability clauses for data breaches or non-compliance.
5. Oversight and Monitoring
5.1 Performance Monitoring
Track supplier performance on reliability, compliance, and support responsiveness.
Maintain a log of supplier-related incidents, such as outages, breaches, or SLA violations.
5.2 Periodic Reviews
Conduct periodic compliance reviews for critical suppliers.
Evaluate the need for renewed certifications, updated agreements, or additional audits.
5.3 Auditing Rights
Howwe reserves the right to audit supplier systems and processes to ensure compliance with contractual and regulatory obligations.
5.4 SSD Compliance
Suppliers must adhere to SSD requirements, including:
Providing evidence of incident reporting processes.
Certifying secure data destruction upon termination.
Enforcing least privilege access and MFA.
Suppliers must notify Howwe of security incidents, zero-day vulnerabilities, or personal data breaches within 24 hours.
6. Supplier Database Management
6.1 Centralized Database
Maintain a centralized database cataloging all third-party suppliers, including:
Supplier name and contact details.
Description of services provided.
Risk classification (e.g., critical, high, medium, low).
Contract details, including expiration and renewal dates.
6.2 Access Control
Restrict access to supplier data in the database to authorized personnel.
6.3 Continuous Updates
Regularly update the database to reflect:
New supplier engagements.
Changes in risk profiles or compliance status.
Contract amendments or terminations.
7. Policy Review and Updates
This policy is reviewed annually or in response to significant regulatory, operational, or technological changes. Feedback from risk assessments, incidents, and audits informs updates to strengthen supplier management practices.
8. Relevant Sources
EU GDPR Overview
Regulation governing the collection, processing, and protection of PII within the European Union.
ISO 27001 Standards
Global standards for establishing and maintaining robust information security management systems.
CCPA Overview
California Consumer Privacy Act outlines data privacy rights and obligations for businesses.
NIST Vendor Risk Management Practices
Guidelines for assessing and mitigating risks associated with third-party service providers.
Google Cloud Compliance
Documentation on Google’s compliance with global standards and regulations for data security and privacy.