Third-Party Service Provider Policy

Third-Party Service Provider Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

This Policy establishes requirements by which Safire, Inc. will manage security risks associated with Third Party Service Providers (“TPSPs”) and all other contracted provider arrangements. The intent is to ensure that the security of company information and information assets is not reduced when exchanging information with third parties or by the introduction of third-party products or services into the company environment.

Scope

This Policy covers all Safire TPSPs and all other contracted provider arrangements. All Safire employees, including third parties and contractors, are required to comply with this Policy.

Policy

1.Risk Management and Governance

Safire shall manage and address the security risk of TPSPs that may have access to Safire’s data or provide products or services to Safire.

To ensure effective segregation of duties, Authority and Approval for TPSP security controls and policy requirements reside with the CISO, IT, and Compliance departments. The requisite business areas requesting the third-party service retain Oversight and Ownership of the relationship but do not hold authority over security stipulations. Any risk acceptance disputes or material findings shall be escalated directly from CISO, IT, and Compliance to the CEO.

Objectives

Safire will establish a Risk Assessment process to identify, measure, mitigate, and monitor risks to Safire’s data, information systems, and Nonpublic Information (NPI) accessible to, or held by, third parties.

Safire will establish a due diligence process for prospective TPSPs, which addresses, at a minimum, a TPSP’s:

• Financial condition
• Reputation
• Cybersecurity practices
• Insurance coverage
• Dependencies on critical third parties and strategic partners

Third-Party Risk Assessment & Due Diligence

Safire will utilize a Third-Party Risk Assessment Checklist to identify the risks of using a TPSP and determine if the third party’s practices could have a negative impact on Safire. Elements of the TPSP evaluation will include:

• Need to access NPI, Personally Identifiable Information (PII), or Electronic Health Information (ePHI)
• Need to access financial or confidential data
• Need to access Safire’s internal network
• Audit program or SSAE18/SOC 2 reporting
• Cybersecurity Program maturity
• Vulnerability and penetration testing program
• Cybersecurity insurance coverage
• Involvement in recent cyberattacks or data breaches
• Compliance with federal and state laws and regulations

Safire will review these findings to decide whether to pursue the relationship and will conduct further due diligence to analyze whether the TPSP meets Safire’s regulatory requirements.

Third-Party Ranking (Tracking)

To increase monitoring effectiveness, Safire will periodically rank TPSP relationships according to risk.

• Rankings will be based on the relationship’s residual risk after analyzing the inherent risk relative to the controls in place.
• Relationships determined to be Higher Risk will receive more frequent and stringent monitoring of their performance (financial and/or operational) and more frequent control validation reviews.

Third-Party Monitoring & Review

Safire maintains a review program to ensure TPSPs deliver the quantity and quality of services agreed upon and maintain security standards.

• Service Reporting: Safire will monitor the service, reports, and records provided by a TPSP at intervals based on their risk ranking.
• Audits: Safire will review independent audit reports (e.g., SOC 2, ISO 27001) provided by the TPSP. Where contractually permitted and deemed necessary by risk ranking, Safire may conduct or commission specific audits to ensure compliance with agreements.
• Business Reviews: Safire will conduct regular meetings as required by SLAs to review reports, audit trails, security events, operational issues, and disruptions.
• Connectivity: Safire will periodically audit network connections with TPSPs to ensure that the connections are appropriate and meet all security requirements.

Termination and Offboarding

Upon termination of a TPSP contract, Safire shall ensure that all access to Safire systems is revoked immediately and that all Safire data held by the TPSP is returned or securely destroyed.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Risk Assessment Policy
• Third Party Risk Assessment Checklist

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page