PP-8-11 Information Technology Outsourcing Policy Procedure
| File Reference : | PP-8-11 Information Technology Outsourcing Policy |
This policy procedure sets out how outsourced suppliers are appraised for information security, and when contracts and confidentiality agreements are put in place.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on supplier information security:
Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download.
If you'd like hands-on help appraising suppliers and setting up confidentiality agreements, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Information Technology Outsourcing Policy Procedure Template
The Information Technology Outsourcing Policy Procedure is a Word template that sets out how a business manages information security for activities outsourced to third parties. It covers outsourcing risk assessment, use of approved suppliers only, security appraisal based on the information a supplier needs to access, contractual agreements for the life of the work and confidentiality agreements.
It applies to all employees and company activities, with disciplinary action for breaches. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.
What the Policy Covers
- Amendment record, summary, scope and applicability - the purpose of managing information security in outsourced activities, the activities and staff covered, and disciplinary action for breaches
- Management of outsourcing risks - periodic risk assessments of outsourcing business activities or services, with findings actioned and the policy kept in line with current controls
- Approved suppliers and appraisal - outsourcing only to approved suppliers, with further appraisal of any supplier who will have access to company information assets
- Contracts and confidentiality - contractual agreements based on the access needed, kept in place for the project or contract, and confidentiality agreements for confidential information
Built for Secure Outsourced Services
- Information security considered as part of every supplier appraisal
- Appraisal based on the access a supplier needs and the classification of the information
- Contractual agreements maintained for the full duration of the project or contract
- Non-disclosure or confidentiality agreements for third parties accessing confidential information
Who Needs an Information Technology Outsourcing Policy Procedure?
Businesses that outsource IT or other services to third party suppliers or service providers who need access to company information.
Using the Policy
Edit the supplier approval and appraisal steps to match your own purchasing arrangements, and name the person in the Controlled By field. Give it top level approval and brief those who select and manage suppliers.
Related Documents
GG-8-05 Secure Project Management and Outsourcing Guidance and TT-8-05 Secure Project Management and Outsourcing Training Talk help managers and staff apply these supplier controls in practice.
Confidentiality Agreements for Third Parties
Outsourcing to a third party supplier or service provider is accepted as part of normal operations, provided only approved suppliers are used. Every third party that needs access to confidential information signs a non-disclosure or confidentiality agreement, which can sit within the contract or a processing agreement.
Wider Purchasing Controls
Supplier approval itself sits within the wider purchasing arrangements. The PP-1-18 Purchasing Outsourced Services Policy Procedure covers supplier appraisal, purchase limits and the review, contracting and control of outsourced services, including agreed information security requirements for suppliers who access or store company information.
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan