# Third Party Security Policy

- Source: https://support.icompaas.com/compliance/policy-docs/third-party-security-policy
- Section: [Compliance](https://support.icompaas.com/compliance) › [Policy Documents](https://support.icompaas.com/compliance/policy-docs) › All policy documents
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Policy Document**·7 mapped controls

## What this policy is

Specifies the security obligations the organization places on third parties that access its systems or data — contract clauses, technical controls, monitoring, and termination.

## Why every organization needs one

Third-party access is one of the most-frequently-exploited entry points. The policy is the contractual and technical baseline that makes it manageable.

## What a competent Third Party Security Policy typically contains

-   Purpose and scope
-   Roles and responsibilities
-   Definitions
-   Third-party access-classification
-   Required security clauses in MSAs / DPAs
-   Technical-control enforcement (SSO, monitoring, JIT)
-   Disconnection workflow
-   Review cadence (typically annual) and version control
-   Approval, sign-off and effective date

## How iCompaas tracks this policy

The icompaas policy-doc producer manages this document through an 8-state lifecycle: `draft` → `generated` → `internal_qa` → `customer_review` → `in_review` → `approved` → `signed` (with `rejected` as a terminal side-state). The producer publishes a `policy_doc_third_party_security_policy_signed` compliance finding once at least one document of this kind reaches the `signed` state for the account being assessed; the finding then rolls up into every compliance framework that references this policy (see the table below).

## Compliance frameworks that reference this policy

The icompaas [compliance controls library](https://support.icompaas.com/compliance) links every policy document to the controls in each framework that require, evidence, or otherwise rely on it. Below: every control across every framework in the iCompaas catalogue that names this policy as part of its evidence base. Each control links to its own dedicated page with auditor-view content + implementation guidance.

| Framework | Control | Title | Component |
| --- | --- | --- | --- |
| ISO/IEC 27001:2022 | [A.5.14](https://support.icompaas.com/compliance/iso-27001-2022/a-5-14-information-transfer) | [Information transfer](https://support.icompaas.com/compliance/iso-27001-2022/a-5-14-information-transfer) | Organizational controls |
| ISO/IEC 27001:2022 | [A.5.19](https://support.icompaas.com/compliance/iso-27001-2022/a-5-19-information-security-in-supplier-relationships) | [Information security in supplier relationships](https://support.icompaas.com/compliance/iso-27001-2022/a-5-19-information-security-in-supplier-relationships) | Organizational controls |
| ISO/IEC 27001:2022 | [A.5.23](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services) | [Information security for use of cloud services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services) | Organizational controls |
| ISO/IEC 27001:2022 | [A.6.6](https://support.icompaas.com/compliance/iso-27001-2022/a-6-6-confidentiality-or-non-disclosure-agreements) | [Confidentiality or non-disclosure agreements](https://support.icompaas.com/compliance/iso-27001-2022/a-6-6-confidentiality-or-non-disclosure-agreements) | People controls |
| ISO/IEC 27001:2022 | [A.8.30](https://support.icompaas.com/compliance/iso-27001-2022/a-8-30-outsourced-development) | [Outsourced development](https://support.icompaas.com/compliance/iso-27001-2022/a-8-30-outsourced-development) | Technological controls |
| ISO/IEC 27701:2025 | [A.1.3.8](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-8-inform-third-parties) | [Inform third parties](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-8-inform-third-parties) | Obligations to PII principals |
| ISO/IEC 42001:2023 | [A.7.3](https://support.icompaas.com/compliance/iso-42001-2023/a-7-3-acquisition-of-data) | [Acquisition of data](https://support.icompaas.com/compliance/iso-42001-2023/a-7-3-acquisition-of-data) | Technological controls |

7 controls across 3 frameworks reference this policy.

## About this page

This article is part of the iCompaas [Policy Documents](https://support.icompaas.com/compliance/policy-docs) library — one page per signed-document type the icompaas policy-doc producer tracks for customer accounts. The article is intentionally framework-agnostic: a customer signing a policy of this kind gets the same regulatory benefit across every framework that references it.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): SOC 2 auditors test that policies like this one exist, are approved, and are reviewed on schedule; the guide lists the full set.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 clause 5.2 and Annex A.5.1 require a documented, approved policy set; the guide shows how it fits the ISMS.