Policy 15 — Third-Party / Vendor Management Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 15. Values shown as [X] are placeholders still to be set.

Purpose

To ensure third parties that handle CHD/PHI on Revique's behalf are governed by written agreements and monitored for compliance.

Scope

Applies to all external vendors and service providers that store, process, or transmit CHD/PHI.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1A list of all third parties handling CHD/PHI must be maintained.

2A written agreement (e.g. BAA/TPSP) must be in place with each such vendor.

3Vendor security and compliance must be reviewed at least annually.

4Due diligence must be performed before engaging a new vendor that handles CHD/PHI.

Roles & responsibilities

Role	Responsibility
Security Officer	Maintain the vendor register and review compliance.
Management	Ensure written agreements are executed.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→