Information Security Policy for Suppliers

Guidelines

• Inter performs risk analysis before formalizing a contract with the supplier.
• For high-risk processing activities, Inter requests additional Due Diligence from a potential service provider, partner, or supplier to ensure they are capable of providing adequate protection.
• The Information Security Policy (or equivalent document) of the service provider, partner, or supplier can be reviewed by Information Security to verify its compliance with Inter's standards and policies.
• The Information Security area may request reports and evidence of the provider's policy compliance, such as control matrices and reports.
• If the Information Security area identifies any risks during the analysis that could compromise Inter's information confidentiality, integrity, and availability, the engagement of the provider may be discussed by the Directorate of Security and Data Governance. Information security and privacy risk assessment for contracts involving personal data with service providers, partners, and suppliers are conducted in accordance with Law 13.709/2018.
• Information security and privacy risk assessments are conducted in contracts with service providers, partners, and suppliers concerning the involvement of personal data, storage, or processing of sensitive information, and cloud computing.
• Cybersecurity controls for cloud computing service providers, partners, and suppliers are assessed in accordance with Resolution 4893 of the Central Bank of Brazil.