Third-Party Management Policy

1. Purpose

     In implementing strategies to achieve business goals in a competitive environment with rapidly changing technology, the Company may engage third-party service providers with proven capabilities and expertise or establish business partnerships to enhance operational efficiency in delivering services and meeting the needs of customers and prospects. Therefore, the Company has established this policy to provide a framework for managing associated risks, including information technology security risks, to ensure they remain within an acceptable level and are aligned with the announcements and guidelines issued by relevant regulatory agencies.

2. Scope

     This policy applies to the engagement of third-party service providers across the Company and its subsidiary. Personnel of the Company and its subsidiary must study, understand, and strictly adhere to this policy.

3. Effective Date

     This policy shall be effective from the date of approval by the Board of Directors.

4. Review Frequency and Revision

     This policy must be reviewed annually, or when a significant change arises.

5. Responsible Function

     The Administration Department and the IT Security and Risk Department are the responsible functions of this policy.

6. Definition

            “The Company” means Bangkok Life Assurance Public Company Limited.

            “Subsidiary” means companies in which the Company holds shares directly or indirectly over 50%.

            “Engagement of Third-Party Service Provider” ” means the use of a third-party service provider to perform, in whole or in part, functions typically performed in-house by the Company.

            “Third-Party Service Provider” means any natural or legal entity that enters into a contract to manage work for the Company as agreed upon, including vendors who supply goods or services, business partners who contribute to the Company's services, business partners who are distribution channels for the Company's products, insurance brokers, and other service providers.

            “Third-Party Risk Management (TPRM)” means the process of identifying, assessing, and managing potential risks arising from the use of services, such as disruption of third-party services and its impact on the Company's customers, the use of system connectivity services, or third-party service providers’ access to critical data of the organization, in order to ensure operational continuity and security.

            “Third Party-Management Life Cycle” means the process of managing third-party service providers, encompassing risk assessment, selection, contract or agreement drafting, ongoing performance monitoring, contract or agreement termination, and information technology security.

            “Service Level Agreement (SLA)” means a contract or agreement between a service provider and a service recipient, which is a document that specifies the details of the service provided and clearly defines the roles and responsibilities of both the service provider and the service recipient.

            “Business Continuity Management (BCM)” means an approach for establishing the Company's policies, standards, and operational procedures to ensure that in the event of a disruption to normal operations, critical systems can continue to operate or be resumed within an appropriate timeframe.

            “Disaster Recovery Plan (DRP)” means a documented plan established for system recovery in the event of a failure, facilitating the recovery of systems and their corresponding functions to a normal operational state.

            “Cyber Incident Response Plan (CIRP)” means a documented plan that specifies the operational procedures for responding to a cyber threat incident.

7. General Principle

     This policy is established to ensure that the Company's operations involving the engagement of third-party service providers maintain a consistent standard for governing and managing associated risks, taking into account business continuity management, customer protection, and the security of the Company's systems and data, in order to effectively achieve the Company's business objectives.

8. Policy

9. Penalty

     Violation of this policy is considered violation of the Company’s Code of Conduct for All Personnel and may constitute an offense against applicable laws, regulations, rules, or requirements.