Vendor Security Assessment Standard

Vendor Security Assessment

1. Purpose

This standard defines the process for evaluating, onboarding, and continuously monitoring the security posture of third-party vendors who have access to Wealthy’s systems, data, or infrastructure. It ensures that vendor relationships do not introduce unacceptable security risks to the organization.

2. Scope

This standard applies to all third-party vendors, service providers, and partners who:

• Access, process, or store Wealthy’s data (customer PII, financial data, transaction records)
• Provide infrastructure or hosting services
• Integrate with Wealthy’s systems via APIs
• Provide software or SaaS tools used in production
• Have physical or logical access to Wealthy’s networks

2.1 Vendor Categories

3. Pre-Onboarding Assessment

3.1 Assessment Triggers

A vendor security assessment is mandatory before:

• Signing a new vendor contract
• Renewing an existing vendor contract (annual)
• Granting a vendor access to new systems or data
• Vendor undergoes significant changes (acquisition, breach disclosure)

3.2 Assessment Questionnaire

Template: Vendor Security Assessment — Checklist Template (Google Sheet, owned by security@wealthy.in, lives in the Security Drive folder). The Wealthy owner makes a copy per vendor, shares the copy with the vendor, and files the returned copy as assessment evidence.

All vendors in Critical and High categories must complete the Vendor Security Questionnaire covering:

A. Organization & Governance

• Information security policy and framework
• Security certifications (ISO 27001, SOC 2, PCI-DSS as applicable)
• Dedicated security team or CISO
• Security awareness training program
• Incident response plan

B. Data Protection

• Data classification and handling procedures
• Encryption standards (at rest and in transit)
• Data retention and disposal policies
• Data backup and recovery procedures
• Cross-border data transfer controls
• PII handling and privacy compliance

C. Access Control

• Identity and access management practices
• Multi-factor authentication implementation
• Privileged access management
• User access review frequency
• Third-party access to their own systems

D. Network & Infrastructure Security

• Network segmentation and firewall controls
• Intrusion detection/prevention systems
• Vulnerability management program
• Patch management SLA
• Physical security controls (for on-premise vendors)

E. Application Security

• Secure development lifecycle (SDLC)
• Code review and static analysis practices
• VAPT frequency and methodology
• API security controls
• Change management procedures

F. Business Continuity

• Disaster recovery plan and RTO/RPO
• Business continuity testing frequency
• Geographic redundancy
• Sub-processor and fourth-party risk management

G. Compliance & Legal

• Regulatory compliance (SEBI, RBI as applicable)
• Data breach notification commitments
• Right to audit clause
• Insurance coverage (cyber liability)

3.3 Assessment Scoring

4. Contractual Security Requirements

All vendor contracts must include the following security clauses:

4.1 Mandatory Clauses

4.2 Additional Clauses (for Critical/High vendors)

• Annual VAPT report sharing
• SOC 2 / ISO 27001 certification maintenance
• Dedicated point of contact for security issues
• Participation in Wealthy’s incident response exercises (if applicable)
• Data residency within India (for financial/PII data)

5. Ongoing Monitoring

5.1 Periodic Review Schedule

5.2 Continuous Monitoring Activities

5.3 Re-Assessment Triggers

Immediate reassessment required when:

• Vendor discloses a data breach
• Vendor undergoes acquisition or merger
• Significant changes to vendor’s service offering
• Regulatory changes affecting vendor compliance
• Wealthy expands scope of data shared with vendor
• Vendor fails to meet SLA commitments repeatedly

6. Vendor Risk Register

Maintain a central Vendor Risk Register documenting:

Location: Maintained in Google Drive (Compliance folder) and reviewed quarterly by CTO.

7. Current Vendor Inventory

7.1 Cloud Infrastructure (Critical)

7.2 Payment & Digital Services (Critical)

7.3 KYC Service Providers (Critical)

7.4 Security Infrastructure (Critical / High)

7.5 Financial Services / Broking (High)

7.6 Insurance API Integration Partners (High)

Integration via secure APIs — quote retrieval, policy issuance. No payments processed through platform.

7.7 Development & Collaboration Tools

7.8 Security Assessment & Audit (Engagement-based)

Audit vendors operate under confidentiality obligations with temporary, limited access and are offboarded after completion.

7.9 Additional Services

Communication, analytics, notification, and engagement tools used on a business-requirement basis. All follow the same assessment and monitoring process.

Examples: SES (email delivery), Yellow (communication), Whistle (notifications), Netcore (email + engagement), Greylabs (communication analytics), Freshdesk / Freshchat (support).

Each is evaluated before integration, granted minimum-necessary access, and reviewed per the cadence defined in §5.1.

8. Vendor Offboarding

When a vendor relationship ends:

1. Access Revocation: All vendor access to Wealthy systems revoked within 24 hours
2. API Key Rotation: Any shared API keys or credentials rotated immediately
3. Data Return: Request formal data return/destruction certificate within 30 days
4. Firewall Rules: Remove any vendor-specific IP allowlists
5. Documentation: Update Vendor Risk Register to mark vendor as inactive
6. Lessons Learned: Document any security issues encountered during the relationship

9. Roles & Responsibilities

10. Compliance Mapping

Version History

Next Review: April 2027 Contact: security@wealthy.in