Yazi Vendor Management Policy
1. Introduction
This Vendor Management Policy ("Policy") outlines Yazi's approach to identifying, onboarding, monitoring, and managing all vendors and third-party service providers ("Vendors") who may have access to Yazi systems, networks, or data, including client data. The Policy is designed to minimise risks associated with third-party relationships, ensure compliance with applicable regulations (such as POPIA and GDPR), and protect Yazi’s operational integrity.
2. Scope
This Policy applies to all vendors that:
Process or store Yazi's or client data
Provide critical services or infrastructure
Have access to Yazi's systems or networks
Integrate with Yazi's WhatsApp research platform
It covers the lifecycle of the vendor relationship, including selection, due diligence, onboarding, ongoing monitoring, and termination.
3. Roles and Responsibilities
Vendor Relationship Owner (VRO): The Yazi employee responsible for initiating the vendor engagement, coordinating due diligence, and acting as the primary liaison.
Legal & Compliance Team: Ensures all contractual and regulatory obligations are addressed, conducts legal review of agreements, and advises on compliance.
Information Security Team: Evaluates and approves the security posture of Vendors, conducts risk assessments, and manages incidents.
Finance Team: Reviews financial viability and ensures that negotiated terms align with Yazi’s budget and payment processes.
Executive Management: Approves strategic or high-risk vendor relationships, especially those handling sensitive or mission-critical operations.
4. Vendor Classification
Yazi classifies Vendors into three risk-based levels:
4.1 Level 1 (Critical)
Vendors with direct access to personal or confidential data
Integration with Yazi's core platform services (e.g., AWS, WhatsApp Business API providers)
High impact on business continuity if services are disrupted
Example: Hosting providers, payment gateways, communication APIs
4.2 Level 2 (Important)
Vendors who have access to some internal systems or process non-sensitive data
Moderate impact on Yazi’s operations
Example: Analytics providers, specialised software tools
4.3 Level 3 (Standard)
Vendors with no direct access to systems or data
Minimal impact on business operations
Example: Office supplies, cleaning services
Classification ensures that due diligence and monitoring are proportionate to the level of risk.
5. Vendor Selection & Due Diligence
5.1 Identification and Evaluation
Business Need Identification: Department requesting the service identifies business objectives and requirements.
Preliminary Vendor Research: A shortlisting of possible Vendors based on capabilities, market presence, and references.
RFP/RFQ Process (If Required): For major or complex engagements, a formal Request for Proposal (RFP) or Request for Quotation (RFQ) may be used to compare Vendors.
5.2 Initial Assessment
All prospective Vendors undergo an evaluation to ensure they meet Yazi’s standards:
Security Capabilities Evaluation: Assess the Vendor’s information security controls and policies.
Regulatory Compliance Check: Confirm Vendor adherence to POPIA, GDPR, or other relevant regulations.
Financial Stability Review: Request financial statements or credit references to verify sustainability.
Technical Capability Assessment: Evaluate the Vendor’s infrastructure, scalability, and compatibility with Yazi’s environment.
Privacy Impact Assessment: For Level 1 Vendors, a formal privacy impact assessment is required to understand data handling risks.
5.3 Documentation Requirements
Depending on the Vendor’s classification, Yazi may request:
Information security policies (e.g., ISO 27001 certification)
Data protection procedures and certifications (e.g., SOC 2, ISO 27701)
Compliance certifications for relevant regulations
Business continuity and disaster recovery plans
Insurance coverage documents
Penetration test reports or vulnerability scans (Level 1 Vendors)
All documentation is reviewed by the relevant Yazi teams to confirm appropriateness.
6. Security Requirements
6.1 Baseline Security Requirements (All Vendors)
Data Encryption: All Vendor-managed data for Yazi must be encrypted both in transit (TLS 1.2 or higher) and at rest.
Access Controls: Implement role-based access with the principle of least privilege. Access to Yazi data or systems must be granted only as necessary.
Incident Reporting: Provide immediate notification to Yazi (within 24 hours) of any security incident affecting Yazi data or operations.
Regular Security Assessments: The Vendor must conduct periodic vulnerability assessments. Yazi may request copies of summary reports.
Employee Screening: Vendors must have background checks or vetting procedures for personnel handling Yazi data.
6.2 Additional Requirements for Level 1 Vendors
Multi-Factor Authentication (MFA): Mandatory for all user accounts with access to Yazi data.
Regular Penetration Testing: Provide evidence of at least annual penetration tests and remediation.
Security Audit Reports: Submit independent audit reports (e.g., ISO 27001, SOC 2 Type II) on a regular basis.
Data Localisation Compliance: Where regulations demand local data storage, the Vendor must ensure data residency within specified jurisdictions.
7. Contractual Requirements
7.1 Mandatory Contract Clauses
Data Protection: Outline obligations regarding personal data handling, including privacy and data protection laws (POPIA, GDPR).
Confidentiality: Prohibit unauthorised disclosure of Yazi information.
Security Standards Compliance: Specify baseline security controls and regular audits.
Incident Reporting: Define timelines and responsibilities for reporting and resolving security or data breaches.
Right to Audit: Allow Yazi or a designated third party to review the Vendor’s compliance with contract terms.
Termination & Exit Clauses: Establish conditions for termination and how data will be returned or destroyed.
Liability & Indemnification: Clarify financial responsibility in the event of data breaches or non-compliance.
7.2 Contract Approval Process
All Vendor agreements must be reviewed and approved by:
Legal & Compliance: Ensures all legal, regulatory, and risk provisions are covered.
Information Security: Confirms alignment with security requirements.
Finance: Reviews financial terms and budgets.
Executive Management: Provides final sign-off for Level 1 Vendors or high-value contracts.
8. Monitoring and Review
8.1 Ongoing Performance Monitoring
Service Level Monitoring: The Vendor Relationship Owner tracks performance metrics (uptime, response times) monthly.
Periodic Review Meetings: Depending on the Vendor’s classification, quarterly or biannual check-ins are held to discuss service quality and any issues.
Risk Assessments: The Information Security Team may require Vendors to complete annual security questionnaires.
Compliance Checks: Vendors handling personal data may need to provide updated privacy statements or compliance reports.
8.2 Documentation
All reviews and assessments must be documented:
Assessment Results & Follow-up Actions
Compliance & Security Reports
Performance Metrics
Incident Reports
These records are maintained by the Vendor Relationship Owner in a central repository and are accessible for audit.
9. Access Control
For Vendors requiring system or data access:
Unique Credentials: Each Vendor user must have a unique ID; shared accounts are prohibited.
Role-Based Access: Access is granted based on job function and is periodically reviewed.
Access Reviews: Departments must review and confirm active Vendor accounts on at least a quarterly basis.
Prompt Termination: Access must be revoked immediately upon the completion of a project or change in Vendor personnel.
Logging and Monitoring: Activities by Vendor accounts are logged; suspicious activity triggers an investigation.
10. Data Protection
When Vendors process Yazi or client data:
Data Minimisation: Vendors should only collect and process the minimum amount of data necessary.
Purpose Limitation: Data must be used solely for the contracted service.
Storage & Retention: Data must be stored securely and retained only as long as necessary or legally required.
Cross-Border Transfers: Any transfer of data across borders must comply with POPIA, GDPR, or local requirements.
Encryption & Secure Disposal: Ensure encryption at rest, and securely destroy data after contract termination.
11. Incident Management
11.1 Vendor Obligations
Immediate Notification: Vendors must inform Yazi within 24 hours of discovering a breach that may affect Yazi data.
Collaboration: Provide complete cooperation during incident investigations and disclose relevant findings.
Root Cause Analysis & Remediation: Vendors must identify the issue, implement fixes, and prevent recurrence.
Client Notification Support: Where required by law or contract, Vendors must support Yazi in notifying affected clients.
11.2 Post-Incident Review
A post-incident review meeting may be held to evaluate response effectiveness and update any security or process gaps.
12. Business Continuity
12.1 Vendor Responsibilities
Continuity & Recovery Plans: Vendors must maintain documented plans for business continuity, disaster recovery, and workforce continuity.
Regular Testing: Plans must be tested at least annually.
Recovery Objectives: Clearly define recovery time and recovery point objectives (RTO/RPO) for critical services.
Backup Procedures: Data backups must be performed regularly and stored securely.
Alternative Arrangements: In case of an extended disruption, Vendors must have contingency options to continue critical services.
13. Vendor Termination
13.1 Exit Management
Notice Period: Observe contractually required notice.
Data Return/Destruction: Ensure all Yazi or client data is returned or securely destroyed.
System Access Removal: Revoke access rights promptly.
Knowledge Transfer: Where needed, Vendors must assist in transferring knowledge to new providers or Yazi teams.
Final Security Audit: May be performed to confirm that data has been appropriately disposed of.
13.2 Documentation
A formal termination report should record:
Reason for termination
Completed exit tasks
Lessons learned
14. Compliance Monitoring
14.1 Audits
Yazi reserves the right to audit Vendors for compliance with contractual and regulatory obligations, particularly if the Vendor handles Level 1 or Level 2 data.
14.2 Remediation
If audit findings reveal non-compliance or security gaps, the Vendor must provide a remediation plan and timeline.
15. Policy Governance
15.1 Review & Updates
Annual Review: This Policy is reviewed annually by Yazi’s Legal & Compliance and Information Security teams.
Continuous Improvement: Feedback from incidents, audits, or lessons learned is incorporated as needed.
Change Management: Major changes must be approved by Executive Management.
Stakeholder Communication: Updated versions are communicated to relevant internal and external stakeholders.
Training Requirements: Yazi employees involved in vendor management must complete periodic training on Policy requirements.
15.2 Documentation Requirements
Mandatory records:
Vendor agreements and addendums
Security assessments, questionnaires, and audit reports
Performance reports and SLAs
Incident logs
Access records and termination proofs
Last updated