Markdown Editor
에디터 열기

ISMS 공급자 보안 키트

공급자 정보보호를 수명주기 전반에서 관리: 공급자 대장과 평가, 27036 계약, 외주 개발, 고객 부속서, 공급망 보안, 연간 검토, 클라우드 종료 계획.

사용 순서에 따라 4단계로 정리한 템플릿 8개입니다. 편집기에서 템플릿을 열어 작성한 뒤 PDF, DOCX 또는 HTML로 내보낼 수 있습니다.

1단계

소싱

  1. Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

    표준

    Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

    ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022

  2. Supplier Security Assessment Template

    전체

    Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

    ISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022, 27036-3:2023; NIS2, DORA, CRA
2단계

계약

  1. Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)

    전체

    Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

    ISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023

  2. Outsourced Development Security Template (ISO/IEC 27001 A.8.30)

    전체

    Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

    ISO/IEC 27001:2022 A.8.30, A.5.19 to A.5.22 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022

  3. Customer Security Addendum Template (ISO/IEC 27001 A.5.20)

    전체

    Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

    ISO/IEC 27001:2022 A.5.14, A.5.20, A.5.31, A.5.34 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022
3단계

모니터링

  1. Software Supply Chain Security Assessment Template (SLSA)

    전체

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)

    전체

    12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

    ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015
4단계

종료

  1. Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)

    전체

    Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act

    ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016