Edit page or add comments

IT Guidance for employing 3rd parties

What is this Guidance for? Who is it for?

When we employ 3rd parties to work with us, we need to ensure we maintain control over our data security, in the same way we would if we were hiring directly. This should help us decide what IT equipment a new 3rd party can use, and how we make that happen.

This guidance implements and is supported by the Device Policy.

We do these things to maintain the requirements of our ISMS and its ISO 27001 accreditation and Cyber Essentials, both of which enable us to fulfill the contracts we have.

When to act

It takes time to arrange IT hardware. Once you know we are in the process of hiring, such as when we arrange vetting of the person, is a good time to think about and ask for IT hardware.

What to do for a new hire

Check the contracts dxw has with clients that the 3rd party person is going to work on, to see if there are any additional special requirements, and bear these in mind. Then apply the following rules in the order in which they are presented.

  1. Is the person we are employing going to be working on a project where the project can supply configured IT hardware?
  3. Arrange for this IT hardware to be provided.
  4. If time scales are too short then dxw will provide IT hardware, if the client permits this. 
  5. Are they from an agency that we have approved to supply IT hardware?
  7. Arrange with the agency to supply the worker IT hardware.
  8. If time scales or costs make this unsatisfactory, then dxw will provide IT hardware
  9. Do they have a suitable device that fits the requirements of the Trusted Device guidance?
  11. Check that they agree to the requirements.
  12. If they agree, then dxw will ensure their device is compliant
  13. If none of the above.
  15. dxw will provide IT hardware.
  16. No other acceptable options exist. If you get here please contact the ISMS team to help you.

The new hire must also complete new starter training, and read the ISMS manual.

Clients and agencies that are able to provide IT hardware

This is a list of current clients and agencies that can provide IT hardware when asked.

Clients:

Agencies:

dxw to supply 

If we need dxw to supply IT hardware, then this should be detailed in the onboarding AppSheet or new Altas system. You will need to add a delivery address, and the Finance & Operations Assistant (People team and Workplace Tech Lead, can help if this person is not available) will arrange for the device to be sent. The more advanced notice you can give the easier this will be.

Approved agency IT hardware

dxw works with some recruitment agencies that may be able to provide workers with IT hardware. This alone is not adequate for us, from an information security perspective. For this IT to be approved the agency must:

  1. confirm to dxw that the IT falls into scope of a Cyber Essentials Plus accreditation. The agency will be able to provide a certificate, you must check that the ‘scope’ applies to the workers we hire, not just the people who work directly for the agency.
  2. that the agency holds an ISO27001 accreditation and that the ‘scope’ covers the workers we hire, not just the agency staff.  The agency will be able to provide a certificate.
  3. Check that the certificates are issued by a well known/respected issuing organisation (Google can help, or check with the ISMS team). Keep copies of the certificates on file.
  4. Check the expiry dates on the certificates and when they run out request new ones from the agency.
  5. Ask the agency for their Statement of Applicability, have the ISMS manager confirm it is adequate.

If the agency can almost do this, please contact the ISMS team who will help confirm with you if the agency meets our requirements.

When we approve an agency using the above method, we can allow them to provide a worker with IT hardware, for that worker to use when working with us.

Last updated: 22 September 2026