A new Standard Operating Procedure: Temporary Information Security Policy (ISP) Waivers for Use of Non-Corporate SaaS Platforms has been issued to operationalize the existing waiver provisions of the UNDP Information Security Policy for the temporary use of non-corporate Software-as-a-Service (SaaS) platforms acquired under vendor End-User License Agreements. The Standard Operating Procedure establishes a documented, risk-based process for Information Security Policy waivers, reaffirms that corporately approved SaaS platforms remain the preferred option, and clarifies that such waivers do not ...
A new Standard Operating Procedure: Temporary Information Security Policy (ISP) Waivers for Use of Non-Corporate SaaS Platforms has been issued to operationalize the existing waiver provisions of the UNDP Information Security Policy for the temporary use of non-corporate Software-as-a-Service (SaaS) platforms acquired under vendor End-User License Agreements. The Standard Operating Procedure establishes a documented, risk-based process for Information Security Policy waivers, reaffirms that corporately approved SaaS platforms remain the preferred option, and clarifies that such waivers do not replace other applicable corporate review and approval requirements. The Standard Operating Procedure supports the UNDP's efforts to strengthen governance and oversight of non-corporate SaaS solutions through documented risk acceptance, management oversight, and the secure, temporary use of approved exceptions.