Vendor and Third-Party Risk Management

1. Purpose

Valstorm LLC recognizes that our vendors, suppliers, and third-party partners are an extension of our operations. Our Vendor and Third-Party Risk Management policy ensures that these partners meet our security and compliance standards before they are entrusted with any company or customer data. The goal is to minimize the risks associated with sharing information and relying on external services.

---

2. Vendor Management Lifecycle

We manage third-party risk through a structured lifecycle approach:

• Due Diligence and Onboarding: Before entering into any new agreement, we conduct a thorough security review of the potential vendor. This process includes evaluating their security policies, controls, and compliance certifications to ensure they align with our requirements.
• Contractual Security Requirements: All contracts with third parties who handle our data include specific security obligations. These legally binding agreements mandate that vendors adhere to strict confidentiality, data protection, and incident notification requirements.
• Ongoing Monitoring: Our responsibility doesn't end after a contract is signed. We perform periodic reviews of our critical vendors to ensure their security posture remains effective over time. This helps us verify their ongoing compliance with our standards.
• Secure Offboarding: When a relationship with a vendor ends, we follow a formal offboarding process to ensure all access to Valstorm systems and data is revoked in a timely manner and that any retained data is securely returned or destroyed according to our policies.