Third Party Service Delivery Management

Where 3rd party service delivery is used to provide operational services to ThingLogix, security controls, service definitions and delivery levels should be specified in the relevant contracts and agreements. At a minimum, 3rd party providers should adhere to ThingLogix InfoSec policies, where applicable. Services, reports and records from the 3rd party supplier should be regularly reviewed and monitored. Audits of the services provided should be planned and conducted on a regular basis. A review of 3rd party compliance with contracted security compliance should be conducted either before contracting with firm (if possible), or within first year after contracting; then once every other year thereafter.

Management of the relationship between ThingLogix and the 3rd party service supplier should be carried out by a nominated team within the organization. This should focus largely on the technical and security compliance of the 3rd party with the contractual agreements in place. The main areas of focus will be:

• monitoring of service levels against the agreements,
• review of service reports,
• security status and incident reporting,
• review of audit trails and records of security events, operational problems, failures and service disruption,
• Management and resolution of identified problems.

Policy for Managing Offshore Service Delivery