› Help › All Categories › Enterprise Security Assessment > Risk and Security Management > Risk Assessment and Treatment

Do you have contracts for all subcontractors requiring assessment?

book reader icon
1 Minute
12/05/2024
facebook logo gray
linkedin logo gray
mail logo gray

Yes. QR Planet assesses all its future service providers, dependent service providers, sub-processors or subcontractors prior to engagement and has contracts in effect with all of them.

Here you can find more information on the clauses included in these contracts.

Last update 10 months ago

Do you have a formalized Risk Governance Plan that defines Enterprise Risk Management program requirements?

Not necessary. IT security policies, incident management, regular external security testing, and extended liability and cyber insurance are in place.

Do you have a formalized Risk Assessment Process in place, handling risks based on relevant risk acceptance levels?

No. The formalization of the QR Planet's already existing policies into a broader risk assessment based on predefined risk acceptance levels is planned for Q1.

Do your subcontractors have access to Scoped Systems and Data or to facilities processing the same?

Yes. If necessary, subcontractors have access to our scoped systems and data. We have DPA contracts with our subcontractors, ensuring full compliance.

Do you have a documented program for managing third-party risks in place?

No. As a small LLC, all of QR Planet's operational partners are known to management and are being carefully assessed and monitored. No formalization necessary.