Vendor Risk Management Policy
1. Purpose
This vendor risk management policy establishes the requirements, responsibilities, and expectations governing how AC5 Labs Demo Co protects information assets, manages risk, and meets its contractual and regulatory obligations. It applies to all employees, contractors, interns, and third parties acting on behalf of the company.
2. Scope
This policy covers all information systems, devices, networks, facilities, and data — whether owned, leased, or operated under contract — that are used to conduct company business. It applies regardless of location and includes remote work, customer environments, and bring-your-own-device arrangements.
3. Roles & Responsibilities
The VP IT owns this policy and is accountable for its content, approval cycle, and exceptions. Department heads are responsible for operationalizing the policy within their teams and ensuring relevant personnel attest within thirty (30) days of hire and annually thereafter.
4. Policy Statements
4.1 The company shall maintain documented controls aligned with the cross-referenced framework requirements listed at the end of this policy.
4.2 Exceptions to this policy must be requested in writing, justified by a documented business need, time-bound, and approved by the policy owner. All approved exceptions shall be logged and reviewed at least annually.
4.3 Violations of this policy may result in disciplinary action up to and including termination of employment or contract, and where applicable, civil or criminal penalties.
5. Compliance & Enforcement
Compliance is verified through periodic internal audits, automated control testing where feasible, and external assessment as part of the company's overall compliance program. Non-conformities will be tracked through the corrective action process and reported to executive leadership monthly.
6. Review
This policy is reviewed at least annually, or sooner if material changes occur in the business, technology environment, or applicable regulations. The reviewer captures changes in the version history and re-attestation is required when a substantive update is published.
Document control: POL-IS-006 v0.9 (DRAFT) · Approved per the version history below.