Robi Axiata Ltd.

Third Party Pre-Association Checklist

Vendor Name
Vendor Address
(Including country)
Vendor web site/URL

Vendor SPOC Name

Vendor SPOC contact details
(Phone & email)
Project/RFP reference

Date of Completion of Checklist

Guidelines for completing the Pre-Association Checklist:

PLEASE DO NOT COPY/PASTE ANSWERS FROM ONE CELL TO ANOTHER.

The objective of the check list is to assess the Information Security controls available in your organization

The check list items are not relevant to the solution/system/product you are proposing to Robi Axiata

Only one tab of this document need to be filled. The appropriate tab need to be selected based on type of solution/system/product provided to Robi Axiata

As best possible, ensure the questions are answered by the most appropriate individual in your organization
 Third Party S
Fill this tab if you provide/intend to provide systems (applications, IT/Telecom network and inform
o Title of the equipment/user license is owned by Robi
o Payments are managed via annual Operational Expenditures (OpEx)
o Robi is responsible for providing first level support
o Robi is responsible for handling customer complaints
These systems will be located within Robi premises and vendors may have physical access to the s

ISO 27001:2013 Domain S.No

Information Security Policies 1

Asset management 2

Access control 4

7
Communications security
8

10
System acquisition,
development and maintenance
11

Incident management 12

Compliance 13

14
Human Resource Security
15
 Third Party Services for Robi Owned Sy
d to provide systems (applications, IT/Telecom network and information/information systems) where :
nse is owned by Robi
ual Operational Expenditures (OpEx)
first level support
customer complaints
hin Robi premises and vendors may have physical access to the same. The vendor may also have remote acc

Requirements

Is there a documented information security policy in place ?

Are information assests indentified and documented ?

Is there a documented password management procedure ?

Is there a documented access management procedure for granting and revoking access ?

Is the user access reviewed periodically ?

Is the traffic between intenel networks and internet restricted though firewalls ?

Is internal networks segrigated and trafic between networks controlled in a suitable manner ?

Is remote access granted though secuere channels such as VPN ?

Are relevant E-mail security controls implemented ?

Are information security requiremnts considered while developing applicaions/systems?

Are secure coding practices followed for application development?

Is there a documented Incident Management Procedure to report ,escalate and resolve information security i

Are all software used properly licensed ?

Is a pre-employment verification process followed to check qualifications / experience and criminal check for

Is there a documented dicipinary process ?

s.

Compliance Status Remarks