Markdown Editor
エディターを開く

ISMS委託先セキュリティキット

委託先の情報セキュリティをライフサイクル全体で管理：委託先台帳と評価、27036契約、外部委託開発、顧客向け付属書、サプライチェーンセキュリティ、年次レビュー、クラウド出口計画。

8 件のテンプレートを、使う順に 4 ステップで並べています。エディターで開いて記入し、PDF、DOCX、HTML に書き出せます。

ステップ 1

調達

  1. Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

    標準

    Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

    ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022

  2. Supplier Security Assessment Template

    フル

    Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

    ISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022, 27036-3:2023; NIS2, DORA, CRA
ステップ 2

契約

  1. Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)

    フル

    Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

    ISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023

  2. Outsourced Development Security Template (ISO/IEC 27001 A.8.30)

    フル

    Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

    ISO/IEC 27001:2022 A.8.30, A.5.19 to A.5.22 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022

  3. Customer Security Addendum Template (ISO/IEC 27001 A.5.20)

    フル

    Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

    ISO/IEC 27001:2022 A.5.14, A.5.20, A.5.31, A.5.34 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022
ステップ 3

監視

  1. Software Supply Chain Security Assessment Template (SLSA)

    フル

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)

    フル

    12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

    ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015
ステップ 4

撤退

  1. Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)

    フル

    Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act

    ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016