Supplier Security Policy

1. Purpose

This policy establishes requirements for identifying, assessing, managing, and monitoring information security risks associated with Carriyo's suppliers and third-party service providers, ensuring supplier relationships do not introduce unacceptable risk to Carriyo's information assets. It ensures that suppliers who access, process, store, or transmit Carriyo data or connect to Carriyo systems meet defined security standards throughout the supplier relationship lifecycle. This policy supports ISO 27001:2022 Annex A controls A.5.19 (Information security in supplier relationships), A.5.20 (Addressing information security within supplier agreements), A.5.21 (Managing information security in the ICT supply chain), A.5.22 (Monitoring, review and change management of supplier services), and A.5.23 (Information security for use of cloud services).

2. Scope

This policy applies to all third-party relationships where the supplier:

• Accesses Carriyo's information systems, networks, or data
• Processes, stores, or transmits Carriyo data (including customer data, shipment data, and PII)
• Provides software, hardware, or services integrated into Carriyo's platform
• Provides cloud services (IaaS, PaaS, SaaS) used by Carriyo
• Has physical or logical access to Carriyo environments
• Provides outsourced development, testing, or operational services
• Is critical to business continuity

This includes but is not limited to:

• Cloud service providers (AWS, GCP)
• Carrier and logistics partners integrated via API
• SaaS tools used for internal operations (communication, project management, HR, finance)
• Development contractors and outsourced engineering teams
• Payment processors and financial service providers
• Security service providers (penetration testing, vulnerability scanning)
• Managed service providers and IT support vendors

All Carriyo employees, contractors, and teams involved in procuring, managing, or overseeing supplier relationships are subject to this policy.

3. Supplier Risk Assessment

3.1 Risk Classification

All suppliers are classified into risk tiers based on the nature and extent of their access to Carriyo data and systems:

3.2 Pre-Engagement Assessment

Before onboarding any new Critical or High-tier supplier, the following assessment is conducted:

• Security questionnaire — The supplier completes Carriyo's supplier security questionnaire covering access controls, data protection, incident response, business continuity, and employee security practices
• Certification review — Review of the supplier's security certifications (ISO 27001, SOC 2 Type II preferred for critical suppliers, PCI DSS, or equivalent)
• Privacy assessment — Evaluation of the supplier's data processing practices, data residency, and compliance with applicable privacy regulations (GDPR, CCPA, PDPL); DPAs where required
• Technical assessment — Where applicable, review of the supplier's technical security controls (encryption, access controls, vulnerability management), architecture, and patching practices
• Business continuity — DR capabilities, SLA commitments, and financial stability review to evaluate continuity risk
• Incident response — Incident response capabilities and notification commitments
• Sub-processor management — Review of the supplier's sub-processor management practices
• Reference checks — For Critical-tier suppliers, references from existing customers in similar industries

Medium-tier suppliers require a security questionnaire and certification review at minimum. Low-tier suppliers are exempt from formal security assessment but are subject to standard contractual terms and self-certification.

3.3 Assessment Outcomes

Assessment results are documented (per the Third-Party Vendor Risk Assessment Procedure, CAR-ISMS-PRC-006) and result in one of the following outcomes:

• Approved — The supplier meets Carriyo's security requirements and may proceed to contracting
• Conditionally approved — The supplier has identified gaps that must be addressed within an agreed timeframe before or shortly after engagement
• Rejected — The supplier does not meet minimum security requirements and may not be engaged

3.4 Ongoing Risk Assessment

Existing suppliers are reassessed according to the following schedule:

Reassessment is also triggered by: a security incident involving the supplier; significant changes to the services provided or data accessed; changes in the supplier's security certifications or compliance status; adverse media reports or regulatory actions; or contract renewal.

4. Contractual Security Obligations (A.5.20)

4.1 Mandatory Contractual Provisions

All in-scope contracts (Critical and High-tier) must include:

• Data protection obligations — Clear specification of what data the supplier may access, process, or store, and the security measures required to protect it
• Confidentiality and NDA obligations covering Carriyo's data and business information
• Access controls — MFA, RBAC, and least privilege
• Encryption — Encryption of Carriyo data at rest and in transit, specifying minimum standards (AES-256, TLS 1.2+)
• Security incident notification — 24 hours for Critical-tier suppliers, 48 hours for High-tier
• Right to audit — Carriyo's right to audit the supplier's security controls, directly or through independent third-party audits
• Sub-processor management — Notification before engaging sub-processors and assurance that sub-processors meet equivalent security standards
• Compliance with Carriyo security policies and applicable laws and regulations
• Secure data return/destruction on termination
• Liability and indemnification for breaches
• SLA commitments (uptime, support response, patching)
• Right to terminate if the supplier fails to meet security obligations

4.2 Data Processing Agreements

Where a supplier processes personal data on behalf of Carriyo, a Data Processing Agreement (DPA) must be executed that includes: purpose and scope of processing; types of personal data and categories of data subjects; data processing instructions and limitations; technical and organizational security measures; sub-processor approval and notification procedures; data subject rights assistance obligations; data breach notification requirements; data return and deletion upon termination; and cross-border transfer mechanisms (Standard Contractual Clauses where applicable). DPAs are managed in coordination with the Privacy Policy and PII Handling Procedures (CAR-ISMS-POL-027).

5. Monitoring and Review of Supplier Services (A.5.22)

5.1 Ongoing Monitoring

• Continuous: Monitor supplier security posture; track security bulletins, advisories, and breach notifications
• Service level monitoring: Track supplier performance against agreed SLAs for availability, response time, and incident resolution
• Compliance monitoring: Track the status of supplier security certifications and compliance attestations
• Access review: Periodic review of supplier access to Carriyo systems to ensure it remains appropriate and necessary
• Quarterly: Review the Vendor Risk Register (CAR-ISMS-LST-003)
• Annual: Full reassessment of Critical/High suppliers
• Triggered: After a supplier incident, significant change, or contract renewal

Suppliers must notify Carriyo of material security posture changes. Sub-processor changes require 30-day prior notification for Critical suppliers.

5.2 AWS-Specific Monitoring

Given AWS's role as Carriyo's primary cloud provider (A.5.23), additional monitoring measures apply:

• AWS Health Dashboard is monitored for service advisories and scheduled maintenance
• AWS Security Bulletins are reviewed upon release for relevant vulnerability disclosures
• AWS compliance reports (SOC 2, ISO 27001) are reviewed annually via AWS Artifact
• AWS Trusted Advisor findings are reviewed quarterly for security recommendations
• CloudTrail logs are continuously monitored for AWS API activity

5.3 Supplier Review Meetings

Review outcomes are documented and any identified issues are tracked to resolution.

6. Cloud Service Security (A.5.23)

For cloud services (IaaS, PaaS, SaaS), Carriyo applies the following additional controls:

• Cloud providers are assessed under the shared responsibility model, with Carriyo retaining responsibility for configuration, identity, and data security
• Cloud service security is governed in conjunction with the Cloud Security Policy (CAR-ISMS-POL-028)
• AWS's Data Processing Addendum and SCCs are executed as part of the overall AWS agreement
• Data residency is verified to remain within approved regions

7. Managing Changes in Supplier Services

Suppliers are required to notify Carriyo of changes that may affect the security of services provided, including changes to sub-processors, data processing locations or residency, security controls or architecture, key personnel, certifications or compliance status, and planned migrations, upgrades, or decommissioning. Upon notification, Carriyo assesses the potential security impact; changes that materially alter the risk profile trigger a reassessment. When Carriyo makes changes affecting supplier integrations, affected suppliers are notified per the Change Management Policy (CAR-ISMS-POL-007).

8. Right to Audit

• Critical/High suppliers: contractual annual audit right
• Acceptable evidence: SOC 2 Type II (last 12 months), ISO 27001 certificate, or direct audit
• Penetration test reports may be requested for Critical suppliers
• Self-attestation accepted for Medium/Low only
• Carriyo may engage third-party auditors at its own expense

9. Supply Chain Security (A.5.21)

Carriyo recognizes that information security risks can propagate through the supply chain. The following controls are applied to manage ICT supply chain risk:

• Software supply chain — Third-party libraries, packages, and dependencies are tracked, scanned for vulnerabilities, and updated per the Vulnerability Management Policy (CAR-ISMS-POL-020)
• Infrastructure supply chain — AWS services and managed services are evaluated for their own supply chain security practices as part of the shared responsibility model
• Integration security — API integrations with carrier partners and other third parties use secure authentication (API keys, OAuth 2.0), encrypted transport (TLS 1.2+), and input validation
• Development supply chain — Where outsourced development is used, code is reviewed before merging into Carriyo repositories, and outsourced developers operate under the same security controls as internal development

10. Incident Management

• Suppliers must report incidents affecting Carriyo data within 24 hours
• The Carriyo Incident Management process (CAR-ISMS-POL-011) applies
• The supplier must cooperate with investigation and provide evidence
• Post-incident, the supplier provides a root cause analysis (RCA) and corrective action plan

11. Termination and Exit

• Secure deletion/return of all Carriyo data
• Destruction certification required for Critical/High suppliers
• 90-day minimum transition period for Critical suppliers
• Access credentials revoked immediately

12. Supplier Register

Carriyo maintains a supplier register (Vendor Risk Register, CAR-ISMS-LST-003) that records: supplier name and primary contact; services provided and data accessed; risk tier classification; contract status and expiry dates; security assessment status and last assessment date; certification status (ISO 27001, SOC 2, etc.); sub-processors declared by the supplier; and outstanding issues or action items. The register is reviewed and updated at least quarterly.

13. Roles and Responsibilities

14. References

• CAR-ISMS-PRC-006: Third-Party Vendor Risk Assessment Procedure (detailed process)
• CAR-ISMS-LST-003: Vendor Risk Register
• CAR-ISMS-POL-007: Change Management Policy
• CAR-ISMS-POL-008: Data Protection Policy
• CAR-ISMS-POL-011: Incident Management Policy
• CAR-ISMS-POL-020: Vulnerability Management Policy
• CAR-ISMS-POL-027: Privacy Policy and PII Handling Procedures
• CAR-ISMS-POL-028: Cloud Security Policy
• CAR-ISMS-REC-001: Risk Treatment Plan

Document History: