ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 3.2: Manage each third-party arrangement through its lifecycle: documented due diligence, enforceable contracts with sub-contracting and data clauses, proportionate monitoring and audits, and controlled termination

What does 3.2 require?

Before entering an arrangement the institution assesses its fit with business and IT strategy and its effect on the risk profile and performs documented due diligence approved at the right level, considering the third party's track record and capacity for the contract period, financial viability, business profile and adverse developments, product or service quality against requirements and peers, location and availability of supporting staff, data to be exchanged and its security controls, IT risk management, threat and vulnerability management, resilience and recovery objectives and incident escalation, impact of failure on the institution and customers, independent validation or certification, supply chain resilience including sub-contracting, audit rights or reports, regulatory compliance and jurisdictional factors; third-party individuals are held to the same standards as employees and fully automated online services still receive due diligence. Contracts address due diligence concerns and are formal, documented, vetted for legality and enforceability, cover terms, obligations, responsibilities, dispute management and rights, require sub-contractors to meet performance and regulatory expectations with notification of sub-contracting changes, and oblige third parties handling customer data to comply with data protection and other regulation. The responsible individual or function monitors each arrangement in proportion to its nature, scope and complexity through metrics, reports and meetings, repeats due diligence regularly with management approval, obtains regular independent audits or expert assessments covering the third party's and sub-contractors' IT environment, security controls, incident management and regulatory obligations, tracks outstanding findings and considers termination where unresolved risk exceeds appetite, and escalates issues to senior management promptly. Termination procedures plan for transition to another provider, in-sourcing and abrupt termination while continuing operations; on termination the institution's data, documents and records are handed back, erased, destroyed or made unusable, technical integrations and access configurations such as firewall rules are disconnected and revoked, and every credential and access right the third party held is revoked.