Assess service-provider security

Insurance information security policy, §3.3

Evaluate providers handling sensitive systems or data, record due diligence, negotiate required contractual controls and monitor identified risks. Retain the basis for the review cadence.

Event-driven

Before onboarding a provider and at material changes

Evaluate providers handling sensitive systems or data, record due diligence, negotiate required contractual controls and monitor identified risks. Retain the basis for the review cadence.

• Provider assessment, contract controls and follow-up

  Controlled record with date, owner, source and review history

Third-party risk lead

Leela can prepare a draft and evidence checklist for the accountable reviewer. Adoption and legal conclusions require human review.

Tell Leela about your company to see whether this applies.