Skip to main content

AG Mortgage Bank PLC

Start your mortgage

Third-Party Information Security Policy

1Introduction

AG Mortgage Bank and its core business exist in a wider economic environment in which effective relationships with third parties are critical to its continued success.

The Bank relationships with third parties are based on a clear understanding of its expectations and requirements in the area of information security. These requirements have been documented and agreed in a way that leaves no doubt about the importance we place on the maintenance of effective controls to reduce risk.

This policy describes the controls applicable to managing the information security risks related to third parties accessing AG Mortgage Bank information, Data Centre, and IT systems.

1.1Scope

This policy applies to:

Third parties and those employed by third parties to perform work on AG Mortgage Bank premises, at hosted or outsourced sites, or who have been granted access to AG Mortgage Bank information or systems.

All information in physical and electronic format held by or entrusted to AG Mortgage Bank, throughout the information lifecycle, which includes creation, collection, storage, distribution, archiving and disposal; and

All technology infrastructure and applications supporting AG Mortgage Bank business requirements

2Roles & Responsibilities

2.1Information Security Manager

  • The Information Security Manager is responsible for the development, provisioning and successful execution of the information security processes. The manager must facilitate the implementation of this policy within the respective lines of business and must ensure that the implementation and effectiveness of information security controls related to this policy are monitored through the undertaking of measurements and risk assessments. The Manager is responsible to ensure that this policy is reviewed and updated annually or when necessary.
  • Implementing information security controls relevant to third parties as described in this policy.
  • Monitoring and maintaining third party access.
  • Allowing access only on confirmation/verification of signed contracts/SLAs and acceptable use undertaking
  • Monitoring and ensuring that remedial actions identified in the risk assessment reports are implemented.
  • Attend the monthly or quarterly third party/vendor meetings

2.2Risk Department

The Department is responsible for:

  • Conducting third party risk assessments as described in this policy
  • Reporting risk assessment results to appropriate stakeholders
  • Recommending risk mitigation actions
  • Advising business on third party security controls

2.3The Procuring Department

The Department is responsible for:

  • Liaise with Legal to ensure contracts include security and related clauses as described in this policy.
  • Ensure that due diligence is performed prior to signup of any third parties.
  • Provide third parties with the required information security policies and recording their undertakings.
  • Liaise with AG Mortgage Bank Legal Team to ensure the SLAs and contracts are free of loopholes.

2.4All IT Team Leads

For each IT Unit, the team lead is responsible for:

  • Monitoring service delivery in line with the signed contract/service level agreement (SLA).
  • Monitoring the vendor performance and communicating this to the relevant stakeholders
  • Creating and collating vendor performance reports and communicating the outcome to the relevant stakeholders.

2.5Project Manager

The appointed project manager is responsible for:

  • Ensuring that stakeholders are kept abreast of developments in the project and a communications plan exists
  • Ensuring project delivers on time with the available resources
  • Ensuring planning, initiation, design, monitoring and project closure

3Information Security Requirements

3.1Information Security Due Diligence

Information security due diligence refers to the process used to assess third party security controls against AG Mortgage Bank requirements to gain a level of assurance of their effectiveness and identify potential security risks prior to contractual engagement.

A due diligence exercise must be completed by an authorized business area/department for all third parties who will access or could potentially access AG Mortgage Bank information.

Due diligence must be completed prior to the transfer of or access to AG Mortgage Bank information, or connection to the Bank's systems, by the third party or its staff.

The head of the business area engaging with a third party must ensure that a due diligence has been conducted. The process must be described in a formal third-party risk assessment report and include a review of the following:

  • Sensitivity of information and systems to be accessed or managed.
  • Locations from where access will originate.
  • Security controls implemented.
  • Type of service provided.
  • Competency of the personnel.
  • Legal and regulatory requirements.
  • Level of control over staff or systems employed by the third party.
  • Profile and reputation of the third party
  • Involvement of sub-contractors to the third party.

The due diligence report must provide a summary of the significant risks identified and an overall risk rating of the third party. The risk rating must indicate whether the third party poses a high, medium, or low risk to AG Mortgage Bank. Only low risk third parties should be engaged or where risks are in line with the business risk appetite.

The information security controls implemented by a Third Party must be assessed as part of the Due Diligence exercise.

Remedial actions to mitigate identified risks for all third parties, must be identified and implemented. The due diligence must be updated after an agreed period to determine if the actions were completed and the risk associated with the third party has been reduced to an acceptable level, prior to any contractual engagements.

3.2Security in Contracts

Contracts with third parties accessing AG Mortgage Bank information must clearly state their obligations in terms of protecting information assets and include the following clauses:

  • A requirement for the third party to adhere to relevant information security policies and procedures.
  • A requirement for the third party to be provided with a copy of AG Mortgage Bank Information Security Policy and acknowledge receipt, understanding and adherence to the policy.
  • A requirement for third party employees working on-site to be provided with a copy of AG Mortgage Bank Acceptable Use Policy and acknowledge receipt, understanding and adherence to the policy.
  • In case the third party has access to AG Mortgage Bank physical/IT assets, requirements for asset protection must be incorporated.
  • Physical entry/exit and access mechanisms to facilities
  • A requirement for the third party to request any additional AG Mortgage Bank security documents or information it requires to implement the relevant information security policies.
  • A requirement for the third party to adhere to all relevant local and international laws and regulations regarding the use and protection of information.
  • A requirement for the third party to inform AG Mortgage Bank of any changes to its internal structure, operating environment or ownership that may impact on its services or the security of information.
  • A "right to audit" allowing AG Mortgage Bank to assess the third party's security environment on an ongoing basis.
  • Conditions for termination of the contract without penalty to AG Mortgage Bank should the third party not meet security requirements and pose a risk.
  • A right to revoke the access of third-party employees to AG Mortgage Bank systems, information, or sites in the event of a suspected security breach.
  • A confidentiality/non-disclosure agreement which describes information handling requirements in line with AG Mortgage Bank Information Classification policy.
  • Contracts must be valid for a specified period. Contracts must be reviewed on renewal or where changes are made to the contract. The Head of the business area engaging with a third party must ensure that a formal termination process is followed at the end of a contract period, which must include:
  • Return of all AG Mortgage Bank information assets, equipment and access cards provided to them during their contract period, and Removal of access to all systems.
  • A requirement for third parties to handle AG Mortgage Bank information in line with the classification. Third parties must assign such information, a classification that is of equal or higher security level
  • Disciplinary actions in case of non-compliance or compromise of Information Security
  • Channel of escalation in case of issues/problems
  • Clear indication of Intellectual Property (IP) rights if any
  • Security requirements to be followed in case the third party is sub-contracting activities that involve handling AG Mortgage Bank information
  • Clause for renegotiation of agreements if the security/business/legal/regulatory requirements of AG Mortgage Bank change.

3.3Monitoring and Review of Third-Party services

Formal third-party risk assessments for all high risk third parties must be updated at least every 12 months if the contract period is longer than one year. If the risk rating increases to medium or high, immediate mitigation actions and timelines must be agreed with the third party. If agreed mitigation actions are not implemented or the risk is not addressed within the agreed period, the contract must be terminated.

In addition, further due diligence must be considered where:

  • An information security incident has resulted from a third-party error or negligence.
  • An investigation is being undertaken of a potential third-party breach of policies
  • Major changes have taken place in the structure, operating environment, and ownership of the third party.

3.4Managing Changes to Third Party services

Changes to third party contracts or service level agreements must be managed through a formal change management process. The change process must be initiated through the issue of a request from AG Mortgage Bank or the third party to change a service being delivered through an existing contract.

This request must be documented in a formal Change Request, and provide the following information:

  • Title and number of the original contract.
  • Name of the third party.
  • Name of the change.
  • The originator and date of the request for the change.
  • The reasons for the change.
  • Full details of the change including any specifications.
  • The cost applicable to the change.
  • The timetable for the implementation of the change.
  • A schedule of payments if appropriate.
  • Assessment of the impact of the change.
  • A unique sequential number of the Change request
  • The date on which the Change request shall expire.

Third parties must inform AG Mortgage Bank of changes undertaken within their environment that may impact on the delivery of services. These changes must be managed by the third party in accordance with a formal change management process and in alignment with AG Mortgage Bank Information Security policy and other contractual requirements.

3.5Third Party Cloud Computing Services

The use of third-party cloud computing services is subject to the same controls as other third-party services.

The use of cloud computing services is currently limited and based on an assessment of the risks associated with the service and the security controls provided by the service provider.

Information placed in the cloud must be protected by appropriate security measures, as required by the associated risk. The use of cloud computing services must be supported by a contract which covers all clauses that apply to policy third-party contracts. In addition, the following special provisions related to the use of cloud services must be included:

  • Providing a secure authentication service.
  • Restricting access to authorized users.
  • Implementing appropriate malware monitoring and protection solutions.
  • Sharing security-related information about unusual or malicious activity.
  • Providing advance notification prior to any changes being made to the way service is delivered
  • Taking into consideration any legal or regulatory requirements where some countries do not allow transactions or information to leave their borders.

Information handling requirements as described in the Information Classification Scheme apply to information used in the cloud:

  • Information classified as CONFIDENTIAL may not be used in a cloud environment and if used, it must be in a controlled manner.
  • Information classified as INTERNAL USE can be used in the cloud

The use of cloud-based file hosting facilities is subject to the following requirements:

  • AG Mortgage Bank employees using this service must ensure that their account passwords meet the Bank's Password Policy.
  • All files uploaded to file hosting services must first be password protected and encrypted.
  • The password used to encrypt the file must meet AG Mortgage Bank password complexity requirements and be provided to the recipient in a secure manner through a different communication channel.
  • AG Mortgage Bank employees leaving the Bank must return any data to the Bank.
  • When sharing information with a third party, the shared folder on the file hosting service must be unique to that third party and folders must not be shared.
  • Where cloud-based hosting services are deployed, employees must take into account those certain countries which prohibit the crossing of personal information across country boundaries.

4Violation

The Compliance to this policy is managed by the ISMS Manager and Procurement. Exceptions from any controls identified in this policy must be justified and can only be implemented upon approval obtained through relevant authorities.

Non-compliance may result in disciplinary action.