THIRD-PARTY / VENDOR RISK MANAGEMENT POLICY

This Policy establishes a risk-based framework for selecting, onboarding, assessing, contracting, monitoring and exiting third-party vendors, service providers and business partners used by CYBERVED AI PRIVATE LIMITED.

• Identify and manage third-party operational, financial, information-security, privacy, fraud and compliance risks.
• Apply appropriate due diligence before onboarding.
• Define contractual protections and service expectations.
• Monitor critical vendors throughout the relationship.
• Ensure incidents and material deficiencies are escalated promptly.
• Maintain evidence of vendor oversight.

This Policy applies to vendors, contractors, technology providers, cloud providers, payment/PPI partners, merchants, professional service providers and other third parties whose activities may affect Company operations, customers, data or compliance.

• Critical – failure could materially affect regulated/payment operations, customers, security or business continuity.
• High – material operational, financial, security, privacy or compliance impact.
• Medium – moderate impact or limited access/dependency.
• Low – limited risk and non-critical services.

1. Define business requirement.
2. Identify and assess potential vendor.
3. Perform risk-based due diligence.
4. Review commercial and service terms.
5. Complete required security/privacy/compliance checks.
6. Obtain approvals.
7. Execute agreement before material access or service commencement.

• Corporate identity and ownership information
• Relevant licences/authorisations where applicable
• Service capability and experience
• Information-security controls
• Privacy and data-processing practices
• Financial and operational stability
• Business continuity capability
• Fraud/compliance controls
• Relevant litigation or adverse information where appropriate

Where a vendor is an authorised PPI issuer, bank, payment processor or other regulated partner, applicable regulatory status and contractual responsibilities shall be documented and periodically reviewed.

Vendors with access to systems, APIs, customer information or sensitive data shall be assessed for appropriate security controls based on risk.

Vendors processing personal information shall be subject to appropriate privacy, confidentiality, data-use, security, breach-notification and deletion/return requirements.

• Defined scope and responsibilities
• Service levels / support expectations
• Confidentiality
• Security obligations
• Privacy and data protection
• Incident notification
• Audit / information rights where appropriate
• Subcontracting controls
• Business continuity
• Termination and data return/deletion

Critical or material vendors should have documented service levels, escalation contacts and performance measures appropriate to the service.

Third-party access shall be limited to the minimum required, authorised through appropriate processes and reviewed periodically.

Material subcontracting arrangements shall be disclosed or controlled according to contractual requirements. Vendors remain responsible for subcontractors to the extent agreed.

• Service performance
• Security incidents
• Compliance issues
• Privacy events
• Material operational changes
• Financial/solvency indicators where relevant
• Contract and SLA compliance
• Audit findings

Vendor risk shall be reassessed periodically based on risk tier and whenever there is a material change in service, ownership, access, incident history or regulatory status.

Vendor incidents that may affect customers, systems, data, payments or business operations shall be escalated under the Cyber Incident Response & Cyber Fraud Policy and applicable contractual procedures.

Vendors involved in payment, voucher, settlement or customer funds-related processes shall be subject to appropriate fraud, transaction and financial control assessment.

Critical vendors shall be assessed for continuity and recovery capabilities appropriate to the dependency and service criticality.

Performance may be reviewed against agreed SLAs, incident levels, customer impact, issue resolution, compliance obligations and service quality.

Material deficiencies shall be documented with corrective actions, owners and target dates. High-risk deficiencies may result in enhanced monitoring, suspension or termination.

1. Confirm termination approval.
2. Disable third-party access.
3. Recover or securely delete Company/customer information as required.
4. Settle outstanding financial obligations.
5. Transfer critical knowledge or services where necessary.
6. Complete exit documentation.

Vendor due diligence, approvals, contracts, assessments, performance reviews, incidents, remediation and exit records shall be retained according to applicable requirements.

Potential conflicts involving vendor selection or management shall be disclosed and managed through appropriate approval and segregation measures.

The Company may request appropriate assurance information, audit reports, certifications or other evidence based on vendor risk and contractual rights.

Exceptions to vendor risk requirements shall be documented, risk-assessed and approved by authorised management.

This Policy shall be reviewed at least annually and whenever there is a material change in the vendor ecosystem, products, partners, regulatory requirements or risk environment.