Purpose

This policy establishes guidelines for assessing the cybersecurity risks associated with new suppliers and vendors to protect Chroma Colors Corporation's sensitive information and systems.

Scope

This policy applies to all new suppliers and vendors who have access to Chroma Colors Corporation's systems, data, or information.

Responsibilities:

1. Procurement:
   Identify and evaluate potential suppliers based on cybersecurity risk factors.
2. Information Security: Conduct cybersecurity risk assessments for new suppliers and vendors.
3. Supplier Management: Manage supplier relationships.

Risk Assessment Process:

1. Supplier Identification: Identify all new suppliers and vendors who will have access to Chroma Colors Corporation's systems or data.
2. Risk Assessment: Conduct a thorough cybersecurity risk assessment using the Chroma Supplier Risk assessment based on the NIST Cybersecurity Framework.
3. Assessment Validation – Request three artifacts in support of completed risk questionnaire.
4. Risk Evaluation: Evaluate the identified risks based on their likelihood and potential impact on Chroma Colors Corporation. Submissions should be sent in to the Security and Operations Helpdesk at [email protected]
   
5. Risk Mitigation: Develop and implement appropriate risk mitigation measures to address the identified risks.
6. Documentation:
   Document the risk assessment process, findings, and mitigation measures

Policy Enforcement:

1. Non-Compliance:
   Failure to comply with this policy may result in the termination of the supplier relationship.
2. Regular Reviews: This policy will be reviewed annually to ensure its effectiveness and alignment with evolving cybersecurity threats and best practices

By following this policy, Chroma Colors Corporation can effectively manage cybersecurity risks associated with new suppliers and vendors, protecting its sensitive information and systems