Policy Advisory  Third Party Risk Management Policy

Date:	01/01/2025
Organization:	Cybersecurity and Enterprise Risk Management
Referenced Sources:	MGL Chapter 7D, Section 2

The Third Party Risk Management Policy reinforces the Commonwealth’s commitment to an effective third-party risk management program and outlines the controls necessary to safeguard the Commonwealth’s information assets and reduce risks posed by improper management of third-party relationships, from contract initiation through termination.

Purpose

The purpose of this policy is to establish the minimum security requirements that must be implemented to manage third-party vendors who provide any type of information technology goods and/or services, outsources applications, cloud services, and/or network and security management to the Commonwealth.