Third-Party & Vendor Risk Policy

1. Purpose and scope

This policy governs how UniMatter selects, engages, and monitors third parties that provide services to the firm or that access, store, or process information on its behalf. Its objective is to ensure that the firm’s security and privacy obligations are sustained across its supply chain and that risk introduced by third parties is identified and managed.

This policy applies to all suppliers, subprocessors, cloud providers, and contractors that handle UniMatter or client information, or whose failure would materially affect the firm’s ability to deliver its services.

2. Risk-based assessment

Before a third party is engaged, UniMatter assesses the risk it presents, having regard to the sensitivity of the information involved, the criticality of the service, and the third party’s security and privacy posture. The depth of assessment is proportionate to that risk.

1. The categories and volume of information the third party will handle, and whether that information includes personal information.
2. The third party’s security controls, including its alignment with recognised standards such as ISO/IEC 27001 and the Essential Eight.
3. The location in which information will be stored or processed, and any cross-border disclosure of personal information.
4. The third party’s use of its own subprocessors, and the controls flowing down to them.
5. The third party’s continuity and incident-response arrangements.

3. Cross-border disclosure

Where engaging a third party would involve the disclosure of personal information to an overseas recipient, UniMatter complies with Australian Privacy Principle 8. The firm takes reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles, or otherwise satisfies an exception, before the disclosure is made.

The location of data storage and processing is recorded for each third party, and changes to that location are treated as a material change requiring reassessment.

4. Contractual safeguards

UniMatter engages third parties that handle its information under written terms that impose obligations consistent with this policy and with the firm’s commitments to its clients.

1. Confidentiality and restrictions on the use of information to the purpose of the engagement.
2. Compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where personal information is handled.
3. Defined security controls, and an obligation to notify UniMatter promptly of a security incident or suspected data breach.
4. Controls on the appointment of subprocessors and flow-down of equivalent obligations.
5. Rights of audit or evidence of independent assurance, and obligations on return or deletion of information at the end of the engagement.

5. Onboarding and access

A third party is granted access to UniMatter systems and information only after the assessment is complete and the contractual safeguards are in place. Access is provisioned on the principle of least privilege in accordance with the Access Control Policy and is time-bound to the engagement.

Each third party with access is recorded in the firm’s register of suppliers, together with the information it handles and the basis of its engagement.

6. Ongoing monitoring

UniMatter monitors its material third parties for continued compliance and for changes that alter their risk profile, including changes to ownership, location of processing, security posture, or subprocessors. Material third parties are reassessed periodically and on the occurrence of such a change.

A third party’s security incident affecting UniMatter or client information is managed through the Incident Response Policy.

7. Offboarding

On conclusion of a third-party engagement, UniMatter revokes the third party’s access, confirms the return or secure deletion of information held by the third party, and updates the register of suppliers. Confirmation of deletion is obtained where the information handled warrants it.

8. Roles and review

The principal is accountable for the operation of this policy and for maintaining the register of suppliers. This policy is reviewed at least annually and on any material change to the firm’s supply chain or obligations.

Enquiries concerning this policy may be directed to UniMatter at administrator@unimatter.com.au.