Insurance information security
IS-03Draft
Assess service-provider security
How Leela would run itEvent-driven · before onboarding a provider and at material changes
Proposed stepsThe requirement
Evaluate providers handling sensitive systems or data, record due diligence, negotiate required contractual controls and monitor identified risks. Retain the basis for the review cadence.
- Before this work
- Vendor reports, questionnaires and contracts Approved assessment criteria and review cadence
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
How Leela would run it · proposed steps
- LeelaCollect vendor questionnaires and security reports and compare them with the approved control checklist.Proposed step
- LeelaDraft evidence gaps and contract-control findings and track remediation and evidence expiry.Proposed step
- Third-party risk leadThe risk and legal owners validate findings, negotiate contractual terms and accept vendor risk.Your team decides
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Provider assessment, contract controls and follow-upControlled record with date, owner, source and review history
Evidence
Provider assessment, contract controls and follow-up
Insurance information security §3.3
1
of 1 record
The steps are the library’s proposed workflow for this obligation: a description of the work, not a run. The records are its evidence in the library.