Third-Party and Supplier Security Policy¶
Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management / Security Owner
Effective date: 2026-10-15
Review cycle: Annual; interim revision upon onboarding of a new critical supplier or material contract change
Document control¶
| Role | Name |
|---|---|
| Prepared by | Management / Security Owner (Cloudnaut) |
| Reviewed by | Sandeep AC |
| Approved by | Sandeep AC |
Revision history¶
| Version | Date | Summary | Reviewed by | Approved by |
|---|---|---|---|---|
| 0.1 | 2026-10-15 | Initial draft. | Sandeep AC | — |
| 1.0 | 2026-10-15 | Initial effective release. | Sandeep AC | Sandeep AC |
Purpose¶
This policy sets security requirements for suppliers, service providers, and subcontractors that access, process, or store Cloudnaut or customer information, or that provide services Cloudnaut depends on to deliver securely.
Scope¶
- Subcontractors and individual contractors who perform customer work on Cloudnaut’s behalf.
- SaaS and tool providers used in delivery, for example source control (GitHub, GitLab), code scanning (Snyk, Sonar, Dependabot), endpoint protection (ESET), background verification (Kyra), AI tools, and collaboration platforms.
- Cloud providers used for Cloudnaut-owned resources.
Customer-mandated tools and platforms supplied and governed by the customer are outside this policy; they are governed by the customer.
Roles and responsibilities¶
| Role | Responsibilities |
|---|---|
| Security Owner | Maintains the supplier register; performs due diligence and periodic reviews. |
| Management | Approves critical suppliers and subcontractors; accepts supplier risk. |
| Requester | Raises new supplier requests and describes the data and access involved. |
Policy¶
Classification of suppliers¶
| Tier | Criteria | Examples |
|---|---|---|
| Critical | Accesses customer information or systems, or holds Restricted data. | Subcontractors on customer work; background verification provider; source-control platform |
| Important | Holds Confidential or Internal Cloudnaut data, or supports security controls. | Scanning tools, endpoint protection, collaboration platform |
| Low | No access to Cloudnaut or customer non-public data. | General-purpose utilities |
Before engagement¶
- Due diligence proportionate to tier: for Critical and Important suppliers, review available security assurance (for example ISO 27001 certificate or SOC 2 report, security documentation, data processing terms, data location).
- Contract terms for Critical suppliers and all subcontractors include confidentiality, data protection, security obligations, incident notification to Cloudnaut, right to request evidence, return or deletion of data at termination, and flow-down of customer requirements where applicable.
- Customer approval: use of subcontractors or tools on a customer engagement follows the customer contract; where the contract requires prior approval of subcontractors or sub-processors, it is obtained before use.
- Subcontractor personnel meet the same screening, training, NDA, and endpoint requirements as Cloudnaut personnel (see HR Security Policy) and stay within the boundaries in the Engagement Role Boundaries and Security Governance Policy.
During the relationship¶
- Critical suppliers are reviewed at least annually; Important suppliers at least every two years. Reviews check assurance currency, incidents, and changes in service or data handled.
- Supplier access is limited to what the service needs and removed when no longer required.
- Supplier security incidents affecting Cloudnaut or customer information are handled under the Incident Response and Management Policy.
Termination¶
Access is revoked, Cloudnaut and customer data is returned or deleted with confirmation, and the register is updated.
Exceptions¶
Use of a supplier that does not meet these requirements needs written management approval with a risk assessment, and customer approval when customer information is involved.
Records¶
Supplier register (name, service, tier, data handled, owner, assurance reviewed, review date, contract reference), due diligence records, review records, and customer approvals, held internally.