Terms and Conditions for Vendors
T&Cs for vendors organized according to Kudo's eight cybersecurity domains
Purpose
Establish the operational conditions every vendor must accept and comply with, organized according to the eight domains of the Kudo framework, so that each area of the organization can require from the vendor what corresponds to its risk domain.
Scope
Applies to every vendor onboarded in accordance with the Vendor Management Procedure. A vendor is only subject to the domains relevant to the service it provides.
COR - Organizational Coherence
- The vendor accepts the ISMS policies that apply to it and the statements made in its Onboarding Form.
- It must report corporate changes, changes in shareholder control or legal representation that affect the contractual relationship.
- It cooperates with the risk assessments and compliance audits the organization carries out on its service.
CAP - Application Cybersecurity
- If it develops or maintains software, APIs or integrations for the organization, it must follow secure development lifecycle (SDLC) practices.
- It must declare the third-party and open-source components used, and remediate critical or high vulnerabilities identified before deployment.
CIP - Identity and Endpoint Cybersecurity
- The vendor's staff must use individual, non-shared credentials to access the organization's systems.
- Remote access to the organization's systems requires multi-factor authentication (MFA).
- Granted access is revoked immediately when the service ends or when the vendor's employee who used it leaves.
CIF - Infrastructure Cybersecurity
- If it provides cloud or infrastructure services, the vendor must comply with the agreed shared responsibility model and communicate it explicitly.
- Information in transit and at rest under its custody must be encrypted with current standards.
- It must maintain segmentation between the organization's environments and those of other customers.
THP - Human Talent and Vendors
- Vendor staff providing on-site or remote services must receive basic information security training before starting activities.
- The vendor verifies the background of its own staff according to the risk of the service provided.
- Vendor staff sign their own confidentiality agreements, which don't release the vendor from its contractual liability.
CCN - Business Continuity and Change
- The vendor gives reasonable advance notice of changes that may affect the continuity or quality of the service.
- It has its own continuity plan proportional to the criticality of the service provided.
- Maintenance windows affecting the organization are agreed and communicated in advance.
ADR - Cybersecurity Analysis, Detection and Response
- The vendor notifies the organization of any security incident affecting its data, systems or services within 48 hours of detection.
- It cooperates with the organization in investigating incidents involving its service.
- It proactively reports known vulnerabilities that may affect the organization.
DIA - Data and Artificial Intelligence Cybersecurity
- The vendor processes personal data in accordance with applicable regulations and solely for the purposes authorized by the organization.
- It doesn't use the organization's data to train or retrain artificial intelligence models without prior written authorization.
- It reports the geographic location where it processes or stores the organization's data.
- It deletes or returns the organization's data at the end of the contract, certifying the deletion when requested.
Acceptance and Validity
Accepting these Terms and Conditions is a prerequisite for onboarding the vendor and is formalized in the Vendor Onboarding Form. They remain valid for the term of the signed contract.
Monitoring and Review
These terms are reviewed annually together with the Vendor Management Policy and upon changes to the Kudo framework domains.