Risk assessment activities must be completed before third parties begin work and repeated annually so that gaps between third-party security controls and PYRANA.ai information security standards or regulatory requirements can be identified.

Risk assessment activities must be conducted before the initiation of third parties work

— Pyrana Vendor Management Policy.pdf

be repeated an annual basis

— Pyrana Vendor Management Policy.pdf

to identify any gaps between the third-party security controls and PYRANA.ai Information Security standards/regulatory requirements

— Pyrana Vendor Management Policy.pdf