1. Document Control

• Document Title: Vendor Management Policy

• Document Identifier: POL-ALL-012

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Procurement Officer>

• Approved By: <Executive Risk and Compliance Committee>

2. Purpose

The purpose of this Vendor Management Policy is to establish a formal process for evaluating, onboarding, monitoring, and terminating third-party vendors who provide goods or services to . This policy ensures that vendors are assessed for operational, security, compliance, and financial risks before and throughout the duration of their engagement.

Vendor management is critical to safeguarding the confidentiality, integrity, and availability of ’s systems and data. By enforcing this policy, fulfills its obligations under ISO/IEC 27001:2022 controls A.5.19–A.5.23 and SOC 2 Trust Services Criteria CC1.2 and CC3.4, which require third-party risk management to ensure service provider accountability and control alignment.

3. Scope

This policy applies to all third-party entities and their subcontractors that provide:

• Cloud services or software platforms

• Infrastructure or hosting services

• Customer support or operational outsourcing

• Payment processing, HR, legal, or compliance services

• Access to internal systems or sensitive data

It covers the full vendor lifecycle, including due diligence, contract negotiation, onboarding, ongoing monitoring, and termination. All employees, contractors, and business units involved in vendor engagement must comply with this policy.

4. Policy Statement

shall:

1. Maintain an up-to-date vendor inventory with classification based on data sensitivity and business criticality.

2. Perform formal risk assessments on all new vendors before onboarding, with reassessments annually or upon significant change.

3. Require vendors to meet minimum information security and compliance requirements, aligned with internal policies and regulatory obligations.

4. Include contractual clauses related to data protection, confidentiality, right to audit, breach notification, and service-level agreements (SLAs).

5. Conduct ongoing monitoring of vendor performance, control effectiveness, and SLA adherence.

6. Ensure secure deprovisioning and data return/destruction during offboarding or contract termination.

7. Escalate and resolve any vendor-related incidents in alignment with the organization’s incident response plan.

5. Safeguards

enforces the following vendor management safeguards: