# Vendor and Third-Party Policy
# Cold Bore Ballistics LLC — Internal Reference
# Classification: Confidential

Subordinate to: `CBB_Information_Security_Policy.md` §10

---

## 1. Purpose and Scope

This policy governs how CBB evaluates, onboards, monitors, and offboards third-party vendors and tools that access, store, or process CBB data. It applies to all vendors, SaaS services, contractors, and AI-assisted tooling that touch CBB systems or data.

---

## 2. Governing Principle

No vendor or tool that accesses confidential or PII data may be used in a production capacity until a written Security Review has been completed and approved.

**"Production capacity"** means any use that involves real CBB data, real customer data, or real operational systems — regardless of whether a product has reached its own `1.0.0` milestone.

---

## 3. Security Review Requirement

### 3.1 When a review is required

A Security Review is required before:

- Onboarding any new vendor or SaaS service that will access Confidential or Highly Confidential data
- Granting any contractor or external individual access to CBB systems beyond Tier 1 (Public) data
- Integrating any new AI tool or agent that will operate under CBB credentials or access CBB data
- Expanding an existing vendor's access to a new data tier or system

A review is not required for:

- Tools accessing only Tier 1 (Public) data
- Evaluation and testing in an isolated environment with no real CBB data

### 3.2 Security Review template

The Security Review template is at:

`OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Security_Review_Template.md`

Completed reviews are stored at:

`OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/<domain>/<Vendor>_Security_Review.md`

For hardware integrations, reviews are stored at:

`OneDrive/ScopeDOPE/03_-_Confidential/Hardware/<Device>_Security_Review.md`

### 3.3 Approval

Security Reviews must be approved by the Global Administrator before the vendor is granted access. Approval is documented in the review document itself.

---

## 4. Vendor Risk Register

All active vendors are tracked in the **"CBB Risk Register" SharePoint List** on the Cold Bore Ballistics team site:

`coldboreballistics.sharepoint.com/sites/ColdBoreBallistics` → Lists → **CBB Risk Register**

The register must include for each vendor:

- Vendor name and service description
- Data tier(s) accessed
- Whether a Security Review has been completed (and a link to the review)
- Access type (API key, OAuth, credential delegation, etc.)
- Onboarding date
- Last reviewed date
- Offboarding date (if applicable)

The register must be updated whenever:

- A new vendor is onboarded
- An existing vendor's access scope changes
- A vendor is offboarded

---

## 5. Active Vendor Inventory

The following vendors are currently active. Security Reviews are pending for all vendors listed without a completed review.

| Vendor | Service | Data tier accessed | Security Review |
|---|---|---|---|
| Microsoft (M365 / Entra ID) | Email, calendar, SharePoint, identity | Confidential | Pending |
| Microsoft (Azure) | Infrastructure hosting, Key Vault, DNS | Confidential | Pending |
| Atlassian | Jira, Confluence | Confidential | Pending |
| Twilio | Voice, SMS, IVR | Confidential | Pending |
| SendGrid | Transactional email | General | Pending |
| Slack | Internal communications | Confidential | Pending |
| Namecheap | Domain registrar | General | Pending |
| DocuSeal | Document signing | Confidential | Pending |
| Anthropic (Claude) | AI-assisted development tooling | Confidential | Pending |
| Sentry | App crash / error reporting | Public (anonymous diagnostics) | Draft — approve-with-conditions pending Founder sign-off |

**Note:** Security Reviews for all active vendors are a known open item as of 2026-06-07. Completing these reviews is a priority security action. The authoritative vendor inventory is the **"CBB Risk Register" SharePoint List**; this table is a convenience summary and must be kept consistent with it.

---

## 6. Contractor Access

Contractors are treated as third parties for the purposes of this policy. Before a contractor is granted access to any CBB system:

1. A signed NDA must be on file.
2. The contractor must acknowledge `CBB_Information_Security_Policy.md` and all subordinate policies.
3. Access must be scoped to the minimum required for the engagement.
4. A defined offboarding date or trigger must be agreed upon before access is provisioned.

Contractor credentials follow the same provisioning and offboarding procedures as employee credentials. See `Access_Control_Policy.md` §6 and §7.

---

## 7. Vendor Offboarding

When a vendor relationship ends or a vendor's access is no longer required:

1. Revoke all API keys, OAuth grants, and credentials associated with the vendor.
2. Remove any webhook endpoints, forwarding rules, or integrations that pass CBB data to the vendor.
3. Confirm with the vendor (where contractually required) that CBB data has been deleted from their systems.
4. Update the Vendor Risk Register with the offboarding date.
5. Archive the vendor's Security Review in the appropriate `Obsolete/` subdirectory.

---

## 8. Ongoing Monitoring

Vendor relationships must be reviewed annually to confirm:

- The vendor is still active and the relationship is still needed
- The vendor's security posture has not materially degraded (check for public breach disclosures, SOC 2 report changes, or significant policy changes)
- The access granted remains appropriate and minimal

Any material change to a vendor's security posture triggers an immediate re-review.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Security/Vendor_and_Third_Party_Policy.md` |
| **Cross-references** | `CBB_Information_Security_Policy.md`; `Security_Review_Template.md`; `Access_Control_Policy.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
| DRAFT | 2026-06-09 | Claude Code | — | — | Repointed §4 vendor risk register to the **"CBB Risk Register" SharePoint List** (`coldboreballistics.sharepoint.com/sites/ColdBoreBallistics`) — the register is a SharePoint List, not a file (prior `Process/CBB_Risk_Register.xlsx` and interim `Vendor_Risk_Register.md` paths were both wrong). Synced §5 active-vendor summary: added Sentry; clarified the List is authoritative. Removed non-standard `# Last Updated` header line (per TECHNICAL_DOCUMENTATION_GUIDE §7). |
