On This Page
Other policies
- Personnel policy
- Risk assessment policy
- Information classification policy
- Incident disclosure and notification policy
- Incident response policy
- Incident response process
- BCP/DR policy
- Access control policy
- Password policy
- Change management policy
- Testing policy
- Patch management policy
- Data retention and deletion policy
Third party vendor review policy
51直播 reviews vendor security practices before contracting, and on a regular basis, to ensure vendors properly handle 51直播鈥檚 customer data, confidential data, and other data.
Scope
This policy only applies to vendors or contractors handling 51直播 or its customers鈥� data.
Schedule
Vendors鈥� security practices should be initially evaluated as part of their contract review, and while still in use, on an annual basis.
Contractors must read and acknowledge 51直播鈥檚 security policies as part of their onboarding. Contractors must complete 51直播鈥檚 information security training as part of their onboarding and thereafter, while still under contract, on an annual basis.
Vendor assessment
As part of vendor evaluation and contracting, vendors鈥� security practices should be reviewed to ensure they sufficiently protect 51直播鈥檚 and its customers鈥� data.
The requirements for a vendor may change based on the risk classification of the assets they are handling (see the Information classification policy), such as sensitive data, or access to production resources; and may change during a contract if a vendor鈥檚 scope or responsibilities change.
51直播 will:
- Ask vendors for their SOC 2 type II or type I report for an overview of their current security practices. If a SOC 2 report does not exist or where insufficient information is provided, 51直播 will ask the vendor to complete the .
- Review the vendor鈥檚 responses and compare these to 51直播鈥檚 security policies to identify any gaps where the vendor may have weaker policies.
- For each notable gap or where insufficient information is provided, 51直播 can: ask the vendor to make a change or provide additional information, implement a mitigating control, or accept the risk. These should be documented in the risk register.
51直播 will document vendor information, to help in case of a potential incident. This information includes:
- Vendor name, i.e. Which vendor?
- Vendor contact information, i.e. How do we contact the vendor? List different contacts for billing, support, and/or security where they apply.
- Type of data shared, i.e. What types of data from 51直播 does the vendor collect or otherwise have access to?
- Terms of Service for services provided by the vendor
- Security report or questionnaire shared by the vendor