Free IT Supplier Code of Conduct Template and Generator

This code sets out what [Company Name] (the "company") expects of the suppliers it buys information technology from: that they protect the company's systems and data, act honestly, treat their workers fairly and safely, reduce their environmental impact, take responsibility for the end of life of the products they supply, and show evidence of all this when asked.

A starter for IT purchasing. This code covers IT suppliers only. A company-wide supplier code, covering materials, logistics, contract labor, facilities, and other suppliers, needs owners in human resources, legal, procurement, and sustainability. Until [Company Name] adopts one, this code applies to IT suppliers, and any company-wide code adopted later replaces the parts of this code it covers. This code is the set of expectations shared with suppliers; the internal steps for assessing a vendor's security risk are set by the company vendor risk management policy, where adopted.

The code is informed by the CISA Cybersecurity Performance Goals, NIST supply chain risk management guidance, and the Responsible Business Alliance Code of Conduct. It does not replace the law or the terms of any contract. Where a law, regulation, or contract sets a stricter requirement, the stricter requirement applies.

This code applies to the following suppliers of [Company Name] ("suppliers"), and to their subcontractors when they work on company matters:

• Manufacturers, distributors, and resellers of computers, phones, servers, printers, network equipment, and other IT hardware.
• Software publishers and cloud (SaaS) providers, including the providers of email, file storage, accounting, ERP, and security tools.
• IT service providers, including managed IT and security providers, consultants, developers, and installers.
• Internet, phone, and data center providers.
• IT asset disposal (ITAD) vendors, electronics recyclers, and shredding companies.

When it applies. The code applies to new suppliers from the effective date, and to existing suppliers when their contract is renewed or significantly changed.

Key suppliers. Suppliers with access to company systems or data, suppliers that store company data, and suppliers the business could not operate without are "key suppliers" and receive closer review under this code.

Supplier

A company that sells or provides IT hardware, software, cloud services, IT services, telecom services, or IT disposal and recycling to the company.

Key supplier

A supplier with access to company systems or data, that stores company data, or without which the business could not operate.

Security incident

Any event at a supplier that compromises, or may have compromised, the confidentiality, integrity, or availability of company data or systems.

Take-back program

A supplier program that collects used products or packaging for reuse or recycling.

Corrective action plan

A written, agreed plan, with owners and deadlines, to fix a gap between a supplier's practices and this code.

SOC 2 Type II report

An independent auditor's report on how well a service provider's security controls worked over a period of time.

Suppliers that access, store, or process company data or systems, or that supply products that connect to them, must:

• Maintain a written information security program appropriate to their size and the data they handle.
• Use multi-factor authentication for all access to company systems and data, and for their own administrative and remote access.
• Give their staff only the access to company systems and data they need, remove it promptly when no longer needed, and never share accounts.
• Keep their products and systems on supported versions and apply security updates promptly.
• Notify [Company Name] of any security incident affecting company data or systems within 72 hours of discovery, and cooperate fully with the company's response.
• Tell the company about security vulnerabilities in the products they supply, and the fix or workaround, as soon as they know.
• Use company data only to provide the contracted service, tell the company where it is stored, and never sell it.
• Return or securely delete company data when the work ends, and confirm in writing that it has been done.
• Apply equivalent requirements to any subcontractor that handles company data, and tell the company before using one.

Software and cloud providers. Software and cloud providers should build security into their products by default, for example by supporting multi-factor authentication and single sign-on without extra charge, providing security logs to customers, and publishing how they handle vulnerability reports. The company may use the questions in CISA's Secure by Demand Guide when choosing software.

IT service providers. IT service providers with administrative access must use separate, named accounts protected by phishing-resistant multi-factor authentication where available, secure and monitor their remote management tools, keep a record of who accessed company systems and when, and ensure the company always keeps its own administrator access to its systems and data.

• Comply with all laws that apply to their business and to the products and services they supply.
• Never offer or give bribes, kickbacks, or anything of more than modest value to [Company Name] personnel to win or keep business.
• Disclose any conflict of interest, such as a family or financial relationship with a company employee involved in buying.
• Compete fairly, and keep honest and accurate records, quotes, and invoices.
• Supply only genuine, properly licensed hardware and software, and respect intellectual property.
• Comply with applicable export control and sanctions laws for the products they supply.
• Protect confidential information the company shares with them.

Suppliers must treat their workers with dignity and respect and, at a minimum:

• Use no forced, bonded, or trafficked labor, and no child labor.
• Pay at least the legally required wages and benefits, and keep working hours within the law.
• Not discriminate or tolerate harassment, and respect workers' rights to associate as the law provides.
• Provide a safe and healthy workplace, including for technicians who work at company sites, who must follow company safety rules.
• Let workers raise concerns without fear of retaliation.

Hardware makers. For manufacturers of IT hardware, the company uses the Responsible Business Alliance Code of Conduct, whose sections cover labor, health and safety, environment, ethics, and management systems, as the benchmark. Suppliers that are RBA members, or that can show a comparable code and audit program for their factories and component suppliers, meet this section.

Suppliers must comply with the environmental laws that apply to their operations and products.

In addition, the company expects suppliers to:

• Offer a take-back, trade-in, or recycling option for the products and packaging they supply, or tell the company how to recycle them through a certified recycler.
• Offer energy-efficient products and share energy use information when asked, so the company can compare options.
• Minimize packaging, use recyclable or reusable packaging where practical, and consolidate shipments.
• Comply with laws restricting hazardous substances in electronics, and provide product safety and substance information on request.

Disposal vendors and recyclers. IT disposal vendors and recyclers must hold a current certification to a recognized electronics recycling standard, such as R2 or e-Stewards, the two standards the U.S. EPA names, for the facility that handles company equipment. They must sanitize or destroy all data following NIST SP 800-88, provide certificates, and manage downstream recycling and any export in line with the law and their certification.

Suppliers must be able to show that they meet this code. [Company Name] may ask key suppliers for a self-assessment questionnaire covering the topics in this code, supported by current certifications and independent reports, such as a SOC 2 Type II report, an ISO/IEC 27001 certificate, a sustainability rating scorecard, or a certificate from a recycling standard such as R2 or e-Stewards.

• Requests are proportionate to the supplier's size, its access to company systems and data, and the value of the relationship.
• Where a supplier already has an independent report or certification that covers a topic, the company accepts it instead of asking the same questions again.
• Key suppliers must provide a current certificate of insurance on request.
• Where the contract allows it, the company or its representative may review a key supplier's practices with reasonable notice.
• The company keeps supplier evidence confidential and uses it only to manage the relationship.

1. Before buying, decide whether the supplier will be a key supplier.
2. For key suppliers, collect evidence under this code before signing, and include in the contract the security, data protection, incident notice, and data return or deletion terms in this code.
3. Ask every supplier to acknowledge this code in writing, or include a contract clause that requires compliance with it.
4. Record the supplier, its category, and the evidence received in the supplier list.

Where two suppliers are otherwise comparable, the company prefers the one that better meets this code, including its environmental and take-back expectations.

Reviews. The IT Manager reviews key suppliers at least once a year, checking that evidence and certifications are current and that any incidents were handled as this code requires, and reviews the full supplier list at least once a year.

Falling short. When a supplier does not meet this code, the company and the supplier agree a corrective action plan with deadlines. If the supplier does not complete it, the company may limit the supplier's access, stop new orders, or end the relationship as the contract allows.

Serious breaches. Bribery, forced or child labor, deliberate concealment of a security incident, or other serious breaches of law or ethics are reported to the Chief Executive Officer immediately and may lead to ending the relationship at once, as the contract allows.

Measuring results. The IT Manager reports to the Chief Executive Officer at least once a year on the share of suppliers that have acknowledged this code, the key suppliers reviewed, and open corrective action plans, so the company can report its progress to customers and sustainability assessments.

Suppliers, their workers, and company personnel can report a suspected breach of this code to the IT Manager. Reports can also be made directly to the Chief Executive Officer. The company reviews every report, keeps it as confidential as possible, and does not tolerate retaliation against anyone who reports in good faith.

Exceptions. Some suppliers, such as very large software or cloud providers, will not sign a customer's code. In that case the IT Manager may accept the supplier's own published code, security documentation, and contract terms if they are substantially equivalent, and records the decision. Exceptions for key suppliers require approval by the Chief Executive Officer and are reviewed at least once a year.

Code review. The IT Manager reviews this code no later than October 2, 2027, and sooner after a supplier-related incident, a new customer or regulatory requirement, or the adoption of a company-wide supplier code.

• CISA Cross-Sector Cybersecurity Performance Goals 2.0, goals 1.D and 1.E.
• CISA, Secure by Demand Guide.
• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
• Responsible Business Alliance (RBA) Code of Conduct v8.0.
• EcoVadis Sustainability Rating methodology, Sustainable Procurement theme.
• NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, and the R2 and e-Stewards recycling standards.

Related company policies. This code works together with the [Company Name] vendor risk management, information security, data protection, IT asset disposal, and incident response policies, where adopted. If they conflict, the stricter requirement applies.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this code of conduct below. Increase the document version and obtain approval again each time the code of conduct is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.