Third-Party Risk Management

Governance & Scope

Policy Objective

Establish standardized controls for third-party lifecycle management, ensuring alignment with enterprise risk appetite, regulatory requirements, and operational continuity across 400+ subsidiaries.

Owner: Global Risk Committee

Applicable Entities

All vendors, contractors, SaaS providers, joint venture partners, and supply chain entities processing Aevum Zenth data, assets, or operating within corporate networks.

Scope: Global Operations

Risk Assessment Lifecycle

01

Intake & Classification

Categorize vendor by data sensitivity, criticality, and regulatory exposure.

02

Due Diligence

Financial health, cyber posture, compliance audits, and site inspections.

03

Contracting

SLA enforcement, data processing agreements, and right-to-audit clauses.

04

Onboarding

System access provisioning, security training, and baseline assessments.

05

Continuous Monitoring

Automated risk scoring, quarterly reviews, and incident tracking.

06

Remediation/Exit

Critical gap closure, offboarding protocols, and knowledge transfer.

Risk Matrix & Control Requirements

Risk Category	Assessment Frequency	Required Controls	Approval Level
● High Criticality	Quarterly	SOC 2 Type II, Penetration Testing, ISO 27001, DPA	Division VP + CRO
● Medium Criticality	Semi-Annually	Security Questionnaire, Background Checks, SLA Audit	Director + Risk Manager
● Low Criticality	Annually	Basic Compliance Certificate, Financial Stability Review	Procurement Lead

Compliance & Certification Standards

🛡️

ISO 27001

✓ Certified

🔒

SOC 2 Type II

✓ Certified

📊

NIST CSF 2.0

✓ Aligned

🌍

GDPR / CCPA

✓ Compliant

⚕️

HIPAA

✓ Certified

🏦

FFIEC

✓ In Review

Policy References & Documentation

Defines technical, operational, and administrative security controls required for all third parties. Includes cryptographic standards, access control policies, incident response SLAs, and sub-processor validation protocols.

Governs international data flows, SCC requirements, local storage mandates, and jurisdictional risk mapping. Mandatory for vendors operating across EU, APAC, and North American regions.

Outlines vendor breach notification timelines (72-hour mandate), forensic cooperation requirements, liability clauses, and regulatory reporting pathways aligned with Aevum Zenth's global IRP.

Vendor Compliance Portal

Access assessment templates, submit documentation, track remediation tasks, and manage your compliance profile for Aevum Zenth partnerships.

Access Portal → Download TPRM Manual

Reporting & Escalation

Compliance Hotline

Report vendor violations, security concerns, or contract breaches through our secure, anonymous channel.

compliance-risk@aevumzenth.global

Third-Party Risk Office

Dedicated team for vendor audits, risk scoring, and remediation tracking across all business units.

tprm.ops@aevumzenth.global