Vendor Management

MFC Safe Vendor Management Policy

1. Purpose This policy outlines the processes and standards for evaluating, onboarding, monitoring, and offboarding third-party vendors and SaaS providers engaged by MFC Safe. It ensures vendor services align with our compliance, performance, and security expectations.

2. Scope Applies to all departments at MFC Safe engaging external vendors who deliver software, services, infrastructure, or operational support.

3. Vendor Evaluation

• Due Diligence: Prior to engagement, vendors must undergo a risk assessment covering financial stability, regulatory compliance, cybersecurity posture, data handling, and certifications (e.g., ISO 27001, SOC 2).

• Technical Assessment: Ensure technical compatibility and scalability with our core platforms (e.g., Didge, AWS, MongoDB).

• Security Requirements: Vendors must demonstrate alignment with our security and privacy standards.

4. Onboarding Process

• Contractual Agreements: Contracts must include data protection clauses, service level expectations, audit rights, and termination provisions.

• Documentation: Maintain vendor contact information, roles, escalation paths, and service documentation.

• Access Control: Limit system access to the least privilege necessary. Setup logging and activity monitoring.

5. Ongoing Monitoring

• Performance Reviews: Conduct bi-annual reviews of vendor performance and SLA adherence.

• Compliance Audits: Validate security practices, data storage, and incident response capabilities annually.

• Risk Scoring: Maintain a vendor risk profile updated based on incidents, contract changes, or observed deficiencies.

6. Offboarding Process

• Termination Checklist: Ensure the return or destruction of MFC Safe data, revocation of access, and secure offboarding.

• Exit Review: Document performance, lessons learned, and residual risk.

7. Roles & Responsibilities

• IT and Procurement: Conduct technical and security evaluations.

• Legal Team: Ensure contract compliance and proper documentation.

• Department Leads: Monitor daily performance and escalate issues.

8. Policy Review This policy will be reviewed annually or following a major vendor incident.

Effective Date: 02 April 2025 Approved By: Morena Nucci, COO Policy ID: VMP-001