Supplier & Vendor Management

Managing third-party service provider security

Public

Purpose

This procedure defines how Maelstrom AI assesses, selects, and manages suppliers and vendors so that they are assessed against our security requirements.

Critical Suppliers

Cloudflare

Services: Workers, KV, Durable Objects, Pages, Analytics, DDoS protection Criticality: High - Complete service dependency Security Assessment:

  • SOC 2 Type II certified
  • ISO 27001 certified
  • Enterprise SLA (99.99% uptime)
  • Regular security audits published

Contract Terms:

  • Data processing agreement
  • Security and privacy provisions
  • Incident notification requirements
  • Right to audit

Monitoring:

  • status.cloudflare.com for outages
  • Security advisories reviewed
  • Annual contract review

GitHub

Services: Source control, CI/CD (Actions), artifact hosting, security scanning Criticality: High - Development dependency Security Assessment:

  • SOC 2 Type II certified
  • GitHub Advanced Security features enabled
  • Bug bounty program
  • Regular security updates

Contract Terms:

  • GitHub Enterprise Cloud agreement
  • Data protection addendum
  • Security features included

Monitoring:

  • GitHub status page
  • Security advisories
  • Dependabot alerts

Vendor Selection Process

For New Vendors

Step 1: Requirements

  • Define business need
  • Identify security requirements
  • Determine criticality level

Step 2: Assessment

  • Review vendor security posture
  • Check certifications (ISO 27001, SOC 2)
  • Review terms of service
  • Assess data handling practices

Step 3: Approval

  • Security Lead: Security assessment
  • ISMS Owner: Final approval for critical vendors
  • Document in vendor register

Step 4: Onboarding

  • Sign contracts/agreements
  • Configure security settings
  • Document access credentials
  • Add to monitoring

Vendor Risk Assessment

Risk Factors

FactorLow RiskMedium RiskHigh Risk
Data AccessNo data accessOperational dataSigning keys, secrets
CriticalityNice-to-haveImportant for operationsCritical path
Security PostureISO 27001 + SOC 2Basic securityUnknown/weak
Geographic LocationTrusted jurisdictionsStandardConcerning

Current Vendor Ratings

  1. Cloudflare. High criticality, Low risk (strong security)
  2. GitHub. High criticality, Low risk (strong security)
  3. npm Registry. Medium criticality, Low risk (supply chain controls)

Ongoing Monitoring

Quarterly Review:

  • Verify vendor still meets requirements
  • Check for security incidents
  • Review contract compliance
  • Update risk assessment

Continuous Monitoring:

  • Status pages for outages
  • Security advisories
  • News/breach notifications

Vendor Incidents

If vendor has security incident:

  1. Assess impact to Maelstrom AI
  2. Activate incident response if needed
  3. Communicate with vendor
  4. Document in incident register
  5. Review vendor relationship
  6. Update risk assessment

Vendor Termination

Offboarding Process:

  • Revoke vendor access to our systems
  • Retrieve/delete our data from vendor
  • Terminate contracts
  • Document lessons learned
  • Update vendor register

Open Source Dependencies

Managed via: Supply Chain Security procedures

Controls:

  • Dependency scanning (cargo audit, npm audit)
  • License compliance reviews
  • Vulnerability monitoring
  • Hermetic builds (locked versions)
  1. Supply Chain Security procedures
  2. Risk Register - Supplier risks
  3. Statement of Applicability - Controls A.5.19-A.5.22

Document Information

  • Version. 1.1
  • Effective Date. 2025-01-13
  • Last Updated. 2026-02-16
  • Owner. ISMS Owner
  • Review Frequency. Annually
  • Classification. Public