Supplier security

Answer:

A service provided without SLA and contract normally is a significant risk, because there is no legal means by which you can enforce your requirements to this provider, neither in terms of service performance nor protection of information. A proper approach would be to identify business and security requirements this provider must fulfill and include them in some kind of legal agreement.

These articles will provide you further explanation about security of suppliers:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
- Which security cl auses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/