Lloyd's Minimum Standards - Cyber Security P12.3.4: 12.3.4 Cyber third-party management

Cyber risk from suppliers is managed. Foundational: every third-party supplier vital to critical business processes has been identified and risk assessed; each third party handling company data does so under a suitable legal contract or data processing agreement that is reviewed periodically; and data transfers between the firm and a supplier are carried out securely with technical and procedural controls, for example secure transfer systems and transfer procedures. Intermediate: accounts that let third parties into internal systems undergo cyber risk assessment at intervals and to joiner-mover-leaver and data processing agreement reviews, so that processes involving external resources remain appropriate. Established: each supplier's cyber risk assessment and data transfer arrangements are re-examined on a schedule set by the criticality of the services it provides. Advanced: contracts with critical third parties require their cyber controls to match those of the managing agent, and either permit physical and technical audits of those controls (by the managing agent or a recognised auditor) or require the third party to hold an industry recognised certification. Earlier editions named coverholders and third-party administrators among the parties in scope.