<Document Title> Partners and External Providers Policy

Transcription

1 <Document Title> Partners and External Providers Policy 2018

2 DOCUMENT HISTORY DATE STATUS VERSION REASON NAME Draft 0.1 ISO27001 Internal Requirement ISO Support Team Published 1.0 Version for Approval ISO Support Team Review Annual Review ISO Support Team Update Update Update Update 1.5 Update in order to accommodate: A Managing changes to supplier services A Monitoring and review of supplier services A Information and communication technology supply chain Update the point in order to accommodate Legal involvement in supplier s approval process (4.2) Update in order to accommodate Quality Management System requirements: Rename document; Split the previous version into a policy and a procedure (PR08). Update in order to accommodate Quality Management System requirements: Rename document; Split the previous version into a policy and a procedure (PR08). ISO Support Team ISO Support Team IT Governance Team IT Governance Team GLOSSARY ACRONYM ISMS QMS CSO CTO DEFINITION Information Security Management System Quality Management System Chief Security Officer Chief Technology Officer DOCUMENT CLASSIFICATION CODE INTERNAL USE ONLY PL08_MS_V1.5_Partners and External Providers Policy 2

3 Table of Contents 1. Objective and Scope Information Security Quality Information for Partners and External Providers Related Documentation

4 1. Objective and Scope The purpose of this document is to define the rules for the relationship with suppliers, subcontractors and partners, in order to comply with the following statements: Establish professional collaboration partnerships that create long-term value for both parties, based on trust and mutual interest; Ensure that individual partners and external providers comply with TIMWE policies and standards; Ensure that TIMWE will not be associated with any type of anti-competitive or anti-ethical agreement. This document applies to all Partners and External Providers with the capacity to influence Management Systems, in terms of confidentiality, integrity and availability of the information within the scope of ISMS, as well as in terms of product quality, software quality and delivery or customer management quality. 2. Information Security TIMWE gives particular importance to data security, therefore existing and potential partners as well as external providers must have appropriate controls to ensure the information confidentiality, integrity and appropriate availability is not compromised and these controls are maintained in accordance with TIMWE Security Policy (see Information Security Policy). The reference standard for TIMWE s security policies is ISO27001 and partners and external providers shall comply with the principles of that standard. 3. Quality TIMWE is committed to continuously improve its quality management system and, for such, ensures that partners and external providers processes, products and services do not adversely affect its ability to consistently deliver conforming products and services to its customers. TIMWE determines the controls to be applied to externally provided processes, products and services and the criteria to be applied for their selection and evaluation. The organization shall retain documented information of these activities and any necessary actions arising from the evaluations. 4. Information for Partners and External Providers TIMWE communicates to Partners and External Providers: ISMS and QMS policies and standards; The processes, products and services requirements; The competences needed, including any required qualification of persons; The interactions with the organization; 4

5 Performance control and monitoring measures applied; Verification or validation activities that the organization, or its customer, intends to perform at the external providers premises. Furthermore, clear contractual terms need to be established, concerning to legal obligations covering information security (e.g. data protection, copyright, encryption, etc.). It must be also implied that noncompliance with established policies may constitute a breach of contract and lead to termination of the contractual relationship. Partners and external providers must agree and comply with the requirements settled. 5. Related Documentation Information Security Policy Quality Policy Parters and External Providers Management Procedure 5