Supplier Requirements Communication

One of the daily objectives that ORIENTEED, S.L. sets for itself is the continuous improvement of its capacity to provide its clients with better service and care.

To achieve this objective, ORIENTEED, S.L. has implemented an internal Management System based on the UNE-EN-ISO 27001:2022 standard.

One of the requirements established by the Management System is the need to evaluate and select supplier, maintenance, and subcontracting companies based on their ability to fulfill the commitments they establish with ORIENTEED, S.L.

In accordance with the above, we hereby communicate our continuous evaluation and approval system for supplier companies, as well as the general requirements and those applicable to the provision of their service:

INITIAL EVALUATION OF SUPPLIER, MAINTENANCE, AND SUBCONTRACTING COMPANIES

• Certification / Accreditation: Supplier companies that hold certification of their product or Management System by an accredited certification body will be evaluated favorably. Supplier companies are also evaluated based on the accreditations and qualifications they hold that enable them to carry out their work.
• On Trial: Applied to new supplier companies, which will receive up to three trial orders. Once completed, these will be analyzed to determine their suitability as suppliers for ORIENTEED, S.L. Upon passing the trial period, they will be moved to the historical category.
• Strategic: Supplier companies with which the organization maintains strategic relationships in terms of operations, image, positioning, etc.
• Competence: Applied specifically to subcontracted personnel and companies that meet the requirements set by ORIENTEED, S.L. regarding competencies, experience, and any other specific requirements.
• Exclusivity: Supplier companies that are the sole providers of a given service or product, with no alternative available.
• Historical: Supplier companies that have collaborated with ORIENTEED, S.L. for at least 2 years, which provides reliability and consolidates the quality of their services and their compliance with information security standards.
• Agility: Supplier companies are evaluated based on their speed in delivering the requested service or product.

CONTINUOUS EVALUATION OF SUPPLIER, MAINTENANCE, AND SUBCONTRACTING COMPANIES

Following the initial evaluation, ORIENTEED, S.L. conducts an annual re-evaluation of its supplier companies based on the incidents and non-conformities associated with each supplier or subcontractor.

Likewise, in compliance with the requirements of the applicable standards and in your capacity as a supplier, maintenance, or subcontracting company for our organization, we hereby communicate the minimum requirements applicable to the provision of your service.

GENERAL REQUIREMENTS FOR SERVICE PROVISION

• The supplier company commits to guaranteeing compliance with all requirements specified in the purchase order or external work order.
• At all times, the supplier company is obligated to comply with the legislation applicable to the service being provided (authorizations or registrations as an authorized entity, technical inspections, etc.).
• The supplier company must apply the necessary preventive measures to avoid hazardous or emergency situations during the performance of the assigned work, and must train and inform its personnel regarding the work to be carried out.
• The supplier company must comply with the internal procedures communicated to it with respect to the company's Management System.
• If any risk or emergency situation is detected, it must be reported immediately to any member of the company or to the person who has been attending to them. For this purpose, the following telephone numbers have been made available: 622 588 127 and 618 194 826; and the following email addresses: administration@orienteed.com and technicaloffice@orienteed.com

REQUIREMENTS TO BE EVIDENCED:

• Subcontractors: Prior to the commencement of the service to be provided, the System Manager of our company will indicate the documentation to be submitted or updated based on the work to be carried out.
• Supply companies: Product data sheets, CE marking of the product, warranty certificate, and certification in accordance with UNE-EN-ISO 9001:2015 or other applicable standards, where relevant.
• Hardware and maintenance supplier companies: Information regarding the company's data backups, information on risks to the company, and certification in accordance with UNE-EN-ISO 27001 or other applicable standards, where relevant.
• Cloud service provider companies: Security controls included in contracts or agreements, roles and responsibilities for the service provided in the cloud, notification of service changes prior to deployment to production, notification of potential security threats or incidents occurring in the cloud service, and service availability during migrations.
• Other types of supplier companies (external prevention services, administrative and advisory firms, among others): Provision of relevant documentation such as NDAs, personal data processing agreements as applicable to their activity, and certification in accordance with UNE-EN-ISO 27001 or other applicable standards, where relevant.