The Information Security Procedure for Vendor Management sets out the procedures, including onboarding and offboarding procedures, to assess if vendors have in place the appropriate security controls.