Vendor Management Policy

PurposeCopy Anchor Link

Define what the organization must ensure with its vendors so that dependence on third parties doesn't become an uncontrolled extension of its risk surface: that every vendor with access to information, systems, facilities or critical processes is inventoried, classified, risk-assessed and validated before and during the business relationship.

Why (Strategic Purpose)Copy Anchor Link

Vendors are, together with human talent, one of the organization's most exploited and least visible risk vectors: a third party's failure, breach or non-compliance translates directly into business impact, without the organization having direct operational control over the cause. This policy exists so that management and business areas can:

• Trust that no vendor accesses information or systems without a prior assessment of its risk.
• Negotiate and contract on terms that protect the organization (intellectual property, confidentiality, continuity) without reinventing those terms for every purchase.
• Respond quickly and with traceability when a vendor fails, is investigated or changes status.
• Sustain the confidence of customers, regulators and investors that the organization's supply chain is governed, not just contracted.

The operational development of this purpose —inventory, classification criteria, risks, purchasing committee, onboarding and external validation— is defined in the Vendor Management Procedure.

ObjectivesCopy Anchor Link

• Ensure that no vendor with access to information, systems or facilities operates without having been classified and risk-assessed.
• Ensure that contractual relationships with vendors explicitly protect information security, intellectual property and business continuity.
• Give management visibility and decision-making capability over the most critical vendors through a defined governance body.
• Reduce the likelihood and impact of security, quality or compliance incidents originating with third parties.

ScopeCopy Anchor Link

Applies to all vendors, contractors, subcontractors and third parties who handle sensitive information, access systems or facilities, or whose failure affects the quality or continuity of an organizational product or service.

Guiding PrinciplesCopy Anchor Link

1. No vendor without classification. Every third party with relevant access is inventoried and classified before operating; the level of contractual and validation requirements is proportional to that classification.
2. Vendor risk is organizational risk. The security, continuity, compliance and fourth-party risks a vendor introduces are managed with the same rigor as internal risks.
3. Governance before urgency. Decisions about critical or high-risk vendors go through a collegiate body (Purchasing Committee), not the unilateral decision of whoever requests the purchase.
4. Terms are negotiated once and applied always. The organization protects its intellectual property, confidentiality and continuity through standard clauses and terms and conditions, not ad hoc negotiations for each contract.
5. Verified, not assumed, trust. Onboarding and renewing relevant vendors requires external validation (legal, financial, restrictive lists), not just references provided by the vendor itself.

Governance RolesCopy Anchor Link

• Management: Approves the policy and supports the Purchasing Committee in decisions about critical vendors.
• Purchasing: Owner of the operational vendor management process.
• Information Security: Defines the risk criteria and the security requirements enforceable according to classification.
• Purchasing Committee: Governance body for approving and following up on critical or high-risk vendors.

Monitoring and ReviewCopy Anchor Link

This policy is reviewed at least annually, or upon regulatory changes, relevant incidents with vendors or changes in the organization's risk appetite. Management oversees compliance through the Purchasing Committee's periodic reports.