Markdown Editor
Editor öffnen

Kit ISMS-Lieferantensicherheit

Lieferantensicherheit über den gesamten Lebenszyklus steuern: Lieferantenregister und Bewertungen, 27036-Vereinbarungen, ausgelagerte Entwicklung, Kundenanhang, Lieferkettensicherheit, jährliche Reviews und Cloud-Exit-Planung.

8 Vorlagen in 4 Schritten, in der Reihenfolge der Nutzung. Öffnen Sie eine Vorlage im Editor, füllen Sie sie aus und exportieren Sie sie als PDF, DOCX oder HTML.

Schritt 1

Beschaffung

  1. Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

    Standard

    Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

    ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022

  2. Supplier Security Assessment Template

    Vollständig

    Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

    ISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022, 27036-3:2023; NIS2, DORA, CRA
Schritt 2

Vertrag

  1. Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)

    Vollständig

    Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

    ISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023

  2. Outsourced Development Security Template (ISO/IEC 27001 A.8.30)

    Vollständig

    Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

    ISO/IEC 27001:2022 A.8.30, A.5.19 to A.5.22 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022

  3. Customer Security Addendum Template (ISO/IEC 27001 A.5.20)

    Vollständig

    Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

    ISO/IEC 27001:2022 A.5.14, A.5.20, A.5.31, A.5.34 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022
Schritt 3

Überwachung

  1. Software Supply Chain Security Assessment Template (SLSA)

    Vollständig

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)

    Vollständig

    12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

    ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015
Schritt 4

Ausstieg

  1. Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)

    Vollständig

    Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act

    ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016