scope:

This standard defines the requirements for managing supplier relationships and the protection of TfL's information and IT systems. It applies to Commercial and Procurement teams when selecting and managing suppliers, and to all employees working with suppliers.

Purpose

This standard defines TfL's requirements for information security controls required for effective supplier selection and management. It summarises the information security access controls that align to the information security standard ISO27001.

The standard also supports the Information Technology Security Policy (P116) to manage and protect the confidentiality, integrity and availability of TfL's information assets from threats and vulnerabilities.