Markdown Editor
Ouvrir l'éditeur

Kit sécurité fournisseurs SMSI

Gérer la sécurité des fournisseurs sur tout le cycle de vie : registre et évaluations, accords 27036, développement externalisé, avenant client, sécurité de la chaîne d'approvisionnement, revues annuelles et plan de sortie cloud.

8 modèles en 4 étapes, dans l'ordre d'utilisation. Ouvrez un modèle dans l'éditeur, complétez-le et exportez-le en PDF, DOCX ou HTML.

Étape 1

Achats et sourcing

  1. Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

    Standard

    Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

    ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022

  2. Supplier Security Assessment Template

    Complet

    Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

    ISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022, 27036-3:2023; NIS2, DORA, CRA
Étape 2

Contrat

  1. Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)

    Complet

    Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

    ISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023

  2. Outsourced Development Security Template (ISO/IEC 27001 A.8.30)

    Complet

    Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

    ISO/IEC 27001:2022 A.8.30, A.5.19 to A.5.22 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022

  3. Customer Security Addendum Template (ISO/IEC 27001 A.5.20)

    Complet

    Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

    ISO/IEC 27001:2022 A.5.14, A.5.20, A.5.31, A.5.34 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022
Étape 3

Surveillance

  1. Software Supply Chain Security Assessment Template (SLSA)

    Complet

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)

    Complet

    12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

    ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015
Étape 4

Réversibilité

  1. Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)

    Complet

    Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act

    ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016