Security

Ask something
Discussion Locked

Vendor Security Policy

0 helpful
2 replies

by mike.hiland

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We need to allow a small number of vendors the ability to access our network via VPN. I would like to have a security policy of some sort for this much like the one we have developed for our own employees.

I expect that there would be some legalissues to address being that a vendor is not an employee. Does anyone have a sample to share, or an idea on where I might find some templates? Thanks!

2 replies

by oldefar

Since a security policy is for internal consumption, you don't need to include legal caveats to it.

The Master Purchase Agreement and non-disclosure statements you have with your vendors should cover acceptable use and access. I suggest you discuss with legal and purchasing what is already in place, and that you avoid adding additional bureaucracy. Modify the existing contracts if necessary, but don't add more. :)

Rather than having vendors access your network via VPN, the policy should begin with having vendors access specific systems based on business need, and with only the access level required to meet that business need. You wouldn't give a vendor a master key to the building and all areas inside, so why would you provide the equivelent with your network?

by lordinfidel

You would do this on a per case basis using temporary u/p's.

Also, before you issue the u/p, they need to sign and return a Non-Disclosure and a Authurized Usage Form.

This discussion is closed to new replies.