Markdown Editor
Mở trình soạn thảo

Bộ mẫu bảo mật nhà cung cấp ISMS

Quản lý an toàn thông tin nhà cung cấp suốt vòng đời: sổ đăng ký và đánh giá nhà cung cấp, thỏa thuận 27036, phát triển thuê ngoài, phụ lục khách hàng, an ninh chuỗi cung ứng, rà soát hằng năm và kế hoạch rời đám mây.

8 mẫu trong 4 bước, theo thứ tự sử dụng. Mở mẫu bất kỳ trong trình soạn thảo, điền nội dung rồi xuất ra PDF, DOCX hoặc HTML.

Bước 1

Mua sắm và nhà cung cấp

  1. Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

    Chuẩn

    Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

    ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022

  2. Supplier Security Assessment Template

    Đầy đủ

    Supplier due diligence: profile, tiering and flow, posture checklist, secure development and SBOM, concentration and exit, NIS2/DORA/CRA hooks, decision, size tiers, records

    ISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022, 27036-3:2023; NIS2, DORA, CRA
Bước 2

Hợp đồng

  1. Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)

    Đầy đủ

    Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations

    ISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023

  2. Outsourced Development Security Template (ISO/IEC 27001 A.8.30)

    Đầy đủ

    Engagement tiers, contract security requirements, secure development obligations, IP and escrow, supplier access, acceptance testing, monitoring, offboarding

    ISO/IEC 27001:2022 A.8.30, A.5.19 to A.5.22 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022

  3. Customer Security Addendum Template (ISO/IEC 27001 A.5.20)

    Đầy đủ

    Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook

    ISO/IEC 27001:2022 A.5.14, A.5.20, A.5.31, A.5.34 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-2:2022
Bước 3

Giám sát

  1. Software Supply Chain Security Assessment Template (SLSA)

    Đầy đủ

    Supply chain assessment: SLSA 1.2 levels, CISA 2026 SBOM elements, SSDF mapping, OSPS Baseline, Scorecard v5 probes, VEX, EPSS/SSVC, findings

    SLSA 1.2; CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1; OSPS Baseline

  2. ISMS Annual Calendar Template (ISO/IEC 27001 Recurring Activities)

    Đầy đủ

    12-month ISMS calendar: fixed dates, 30 recurring activities with owners and evidence, month view, Gantt chart, size tiers, rescheduling rules

    ISO/IEC 27001:2022 + Amd 1:2024 clauses 8.1, 9.1 to 9.3 (cited only); ISO/IEC 17021-1:2015
Bước 4

Rút lui

  1. Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)

    Đầy đủ

    Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act

    ISO/IEC 27001:2022 A.5.23 (cited only); ISO/IEC 27002:2022; ISO/IEC 27036-4:2016