> Source: https://security.crystalknows.com//policies/third-party-risk-management · Category: Security · Generated 2026-07-28

# Third-Party Risk Management Policy

**Policy Owner:** Paul Jones  
**Version:** 2.0  
**Effective Date:** 2021-07-06  
**Last Reviewed:** 2026-02-24  

---

## 1. Purpose

To ensure that third-party service providers who access, process, store, or transmit company or customer data maintain appropriate security controls consistent with Crystal Project Inc.’s risk profile.

---

## 2. Scope

This policy applies to:

- Vendors and service providers with access to production systems
- Vendors that process or store customer data
- Critical SaaS providers supporting business operations
- Subprocessors

---

## 3. Third-Party Risk Principles

Crystal Project Inc. applies a risk-based approach to third-party evaluation.

Vendors are assessed proportionate to:

- The sensitivity of data involved
- Level of system access
- Business criticality
- Regulatory exposure

Not all vendors require the same level of review.

---

## 4. Vendor Due Diligence

Before engaging a vendor that may access or process customer data:

- Security posture is evaluated.
- Relevant certifications (e.g., SOC 2) are reviewed where applicable.
- A written agreement or contract is executed.
- Data protection obligations are defined where required.

For critical infrastructure providers (e.g., cloud hosting), reliance may be placed on publicly available security documentation and independent audit reports.

---

## 5. Subprocessor Management

Vendors that process customer data on behalf of Crystal Project Inc. are designated as subprocessors where applicable.

Subprocessors are:

- Documented
- Contractually bound to appropriate data protection obligations
- Reviewed when material service changes occur

---

## 6. Ongoing Monitoring

Third-party services are reviewed periodically based on risk and criticality.

Monitoring may include:

- Reviewing updated audit reports
- Evaluating significant vendor changes
- Reviewing security incidents impacting the vendor
- Reassessing risk during contract renewal

Formal annual reassessments may not be required for low-risk vendors.

---

## 7. Vendor Security Expectations

Third-parties that process customer data are expected to maintain reasonable technical and organizational security controls, including where applicable:

- Access control mechanisms
- Secure system development practices
- Vulnerability management
- Logging and monitoring
- Incident response capabilities
- Business continuity measures

Crystal Project Inc. does not impose uniform control requirements but evaluates vendors proportionate to risk.

---

## 8. Termination of Services

Upon termination of a vendor relationship involving customer data:

- Access must be revoked.
- Data must be returned or securely destroyed in accordance with contractual terms.

---

## 9. Exceptions

Exceptions must be documented and approved by the Policy Owner.

---

## 10. Enforcement

Violations may result in corrective action or termination of vendor relationships where appropriate.

---

## 11. Review and Revision History

| Version | Date | Description | Author |
|----------|------------|-------------|----------|
| 1.0 | 2021-07-06 | Initial Version | Jona Morua |
| 2.0 | 2026-02-24 | Simplified and aligned to operational practice | Paul Jones |