Division of Information Technology
Policy Document No:
DIT Policy for Vendor
& Third-Party Access
Version
Version 1.4
TRIM file number
Short description
DIT Policy for Vendor & Third-Party Access
Relevant to
Approved by
Executive Director
Division of Information Technology
Responsible officer
Executive Director Information Technology
Responsible office
Office of Executive Director of the Division of
Information Technology
Date introduced
26 August 2009
Date(s) modified
14 September 2009
27 October 2009
14 December 2009
24 November 2011
Next scheduled review
date
24 November 2012
Related legislation
Privacy Act 1988
Key words
Vendor, security, privacy, information, access
Page 1 of 5
Division of Information Technology
Policy Document No:
DIT POLICY for Vendor & Third Party Access
Contents
1.
2.
3.
4.
Purpose...............................................................Error! Bookmark not defined.
Scope ................................................................................................................... 2
Policy .................................................................................................................. 2
Author History .................................................................................................... 5
1. Purpose
The DIT Vendor/Third Party Access Policy informs CSU management, business
owners, IT project teams and support staff of the CSU requirements for vendor access
to CSU Information Systems.
The policy defines vendor responsibilities for the protection of CSU information and
information systems.
2. Scope
The DIT Vendor Access Policy applies to all individuals and/or parties that are
responsible for the installation of new CSU Information System assets, and the
operations and maintenance of existing CSU Information Systems, and who do or
may allow vendor access for support, maintenance, monitoring and/or
troubleshooting purposes.
3. Policy
a) Vendor access to CSU Information Resources is granted solely for the work
contracted and for no other purposes.
b) Vendors must comply with all applicable CSU policies, practice standards and
agreements, including, but not limited to:
Page 2 of 5
Division of Information Technology
Policy Document No:







OH&S Policies
Change Management Policies
Privacy Policies
Security Policies
Auditing Policies
Software Licensing Policies
CSU Code of Conduct
All relevant policies are available from the Division of Information Technology
website located here.

c) Vendor agreements and contracts must specify:





The CSU information the vendor should have access to. If, at the time of
contract negations this is unknown or ambiguous, mention of this should
be made in the agreement.
How CSU information is to be protected by the vendor. A copy of the
Vendor’s Security and Privacy Policy should be made available to CSU
where appropriate.
Acceptable methods for the return, destruction or disposal of CSU
information in the vendor’s possession at the end of the contract.
Agreement that the Vendor must only use CSU information and
Information Systems for the purpose of the business agreement.
Any other CSU information acquired by the vendor in the course of the
contract cannot be used for the vendor’s own purposes or divulged to
others.
d) Where applicable, DIT will provide a technical point of contact for the vendor.
The point of contact will work with the vendor to ensure the vendor is in
compliance with CSU policies.
e) Where applicable, the business owner will provide the vendor with a point of
contact from within the relevant School, Section or Division. The internal point of
contact is responsible for liaising with DIT for all relevant Change Management
processes.
f) Before the commencement of the agreement the appropriate implementation of
DIT change management processes will be determined by DIT in consultation
with the Vendor and the CSU business owner. This will include such things as the
definition of standard changes, level and type of communications around changes,
and responsibilities around technical vulnerability management and security
incident reporting.
Page 3 of 5
Division of Information Technology
Policy Document No:
g) At the commencement of the agreement, Standard Changes, as defined in the
context of the CSU change management system, must be clearly identified and
agreed upon by the Business Owner, The Vendor and DIT.
1
All work and changes that are identified as impacting on other CSU systems must
be entered into the DIT Change Management System by the DIT point of contact
or, where applicable, the Business Owner point of contact. Activities include, but
are not limited to, such events as software/operating system updates/patches,
password changes, project milestones, changes to deliverables, and
commencement and completion times, wherever possible.
h) Vendors work activities on CSU systems may be monitored and logged for
comparison to Change Management System records.
i) Before the commencement of the agreement, methods for:




The monitoring and review of service performance,
logging activities,
submission of vendor reports and,
roles and responsibilities regarding problem management
will be determined by DIT in consultation with the Vendor and the CSU business
owner.
j) Each vendor must provide DIT with a list of all employee names working on the
contract. The list must be updated and provided to DIT within 24 hours of staff
changes, wherever possible.
k) Vendor access must be uniquely identifiable and password management must
comply with the CSU Password Policy and the CSU Remote Access Policy.
l) If appropriate, regular work hours and duties will be defined in the contract. Work
outside of defined timeframes must be approved by the appropriate CSU business
owners
m) All vendor maintenance equipment on the CSU network that connects to the
internet via any means, and all vendor accounts, will remain disabled except when
in use for authorized maintenance.
n) Upon departure of a vendor or vendor employee from the contract for any reason,
the vendor will ensure that all sensitive information is collected and returned to
DIT or destroyed within 24 hours.
Page 4 of 5
Division of Information Technology
Policy Document No:
o) Upon termination of contract, or at the request of CSU, the vendor will return or
destroy all CSU information and provide written certification of that return or
destruction within 24 hours.
p) Upon termination of contract, or at the request of DIT, the vendor must surrender
all CSU access cards, badges, and equipment immediately. Equipment and/or
supplies to be retained by the vendor must be documented by authorized DIT
management.
q) Vendors are required to comply with all regulatory and CSU auditing
requirements, including the auditing of the vendor’s work.
r) All software used by the vendor in providing service to CSU must be properly
inventoried and licensed.
s) Each vendor granted access to any CSU Information System must sign the DIT
Vendor Security, Privacy, Copyright and Confidentiality Agreement Form which
stipulates that each individual:



Has read and understands the security policies
Understands the responsibility to comply.
Understands the consequences of an infraction.
Author History
Date
Author
26/8/09
14/9/09
L Weston
L Weston
Version No.
Pages
1
5
1.1
5
27/10/09 L Weston
14/12/09 L Weston
1.2
1.3
5
5
24/11/11 L Weston
1.4
5
Page 5 of 5
Description
Draft Document
Suggested changes by B
Roberson, P Roy, G Taylor
Suggested changes by R Paton
Changes re change
management process
Review for web publication