Third Party Access Policy

The objective of the Third Party Access Policy is to maintain the security of information processing facilities of Company accessed by third parties. These standards are designed to minimize the potential exposure to the Company from damages that may result from unauthorized use of Company  resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical Company internal systems, etc.

In order to access information processing facilities of the Company, every vendor or contractor (including their employees and partners), should provide a written document with all the details of this access and the responsibilities of both parties, either in contract or in an annex to the main contract. If necessary, the annex should allow the security requirements and procedures to be expanded in a security management plan to be agreed between the two parties.

To assess all the risks and to document the security requirements and procedure, a cross-functional team will be formed, led by the Information Security Team and comprising, as required, specialists from relevant departments. Access to information and information processing facilities by third parties should not be provided until the appropriate controls (as established by the above nominated cross-functional team) have been implemented and a contract has been signed defining the terms for the connection or access.