Kit de seguridad de proveedores del SGSI

Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act