If our IT is run by a service provider, whose policies apply?

Start

A service provider runs your IT

Handing over the work does not hand over the accountability. Your policy framework covers security documents written or operated for you by providers, wherever you require your people or theirs to follow them. It does not cover the provider's own internal documents that you do not require anyone to follow.

• Then: Which kind of document is it?

Decision

Which kind of document is it?

Sort each document into one of three kinds: your own policies and standards; procedures the provider writes to carry out your standards on the systems it runs; and the provider's own internal documents, which govern its business rather than yours.

• Your policy or standard: Name the policies its staff must follow and acknowledge
• Provider's procedure for your systems: Put it on your register, owned by your contract owner
• Provider's internal document: Leave it off your register; bind the provider by contract

Step

Name the policies its staff must follow and acknowledge

List in the contract the policies the provider must comply with when working on your premises or systems. Require its staff to acknowledge the policies that apply to them, as your own staff do. The provider may be consulted on documents it must follow, but it never approves them.

• Then: Does the contract already bind the provider to these duties?

Step

Put it on your register, owned by your contract owner

List each provider procedure that carries out your standards on your register as an external document, with your contract owner as owner and the provider's reference in the notes. Your owner obtains the current version and confirms it is reviewed. Your own approver approves it: a provider never approves a document that governs its own work.

• Then: Does the contract already bind the provider to these duties?

Step

Leave it off your register; bind the provider by contract

A provider's internal documents that you do not require anyone to follow are not yours to own or approve. The contract instead requires the provider to run an information security management system to a named standard, such as ISO/IEC 27001 or your own supplier security requirements.

• Then: Does the contract already bind the provider to these duties?

Decision

Does the contract already bind the provider to these duties?

Check the service agreement for five things: a management system to a named standard; compliance with your listed policies on your premises or systems; staff acknowledgement of the policies that apply to them; notice of changes to its procedures that affect your standards; and use of your exception process for any deviation.

• Yes: Your policies govern; the provider's work sits inside them
• No, or not known: Add the missing duties to the agreement

Step

Add the missing duties to the agreement

Use a security requirements clause: a management system to a named standard, compliance with your listed policies, and no reduction in the security of the service during the term. Add the acknowledgement, change-notice and exception duties beside it. A change the provider notifies is a trigger to review the standard it affects.

• Then: Does the provider insist on its own standards instead?

Decision

Does the provider insist on its own standards instead?

This is the usual pushback, and large providers often offer only their own terms. Do not try to rewrite them. Read them against your clauses point by point, and note which points they cover and which they do not.

• No: Your policies govern; the provider's work sits inside them
• Yes: Does its certificate's scope cover the service you buy?

Decision

Does its certificate's scope cover the service you buy?

You can accept the provider's certified standard in place of your own schedule, but only if the certificate's scope covers the service you actually buy. If you cannot tell from the certificate, treat it as not covered.

• Yes: Accept its certified standard in place of your schedule
• No, or not known: Record the refused clause as an exception

Step

Accept its certified standard in place of your schedule

Hold firm on the clause against reducing security during the term: without it, the assessment that approved the provider stops describing it. The duties about your own systems still apply: acknowledgement of your policies, notice of changes and your exception process.

• Then: Your policies govern; the provider's work sits inside them

Outcome

Record the refused clause as an exception

A clause the provider refuses, and which you accept without it, is a gap. Record it as a security exception in every case. If the gap leaves the provider outside appetite or scored Critical, the approver your risk method requires also signs the exception, and the risk goes on your risk register.

Outcome

Your policies govern; the provider's work sits inside them

Your policies apply to your information and on your systems, whoever operates them. The provider's procedures that carry them out are on your register with an owner of yours. Any deviation by the provider goes through your exception process, never by informal agreement.