Domain

Supply chain

19 documents. Third-party, vendor, and supply-chain security management.

This directory contains organization-neutral supplier governance, third-party risk, cloud governance, and supply-chain continuity artefacts. It covers the full lifecycle of supplier and partner relationships as well as trade security programme obligations.

Note

Its original content is released under CC BY-SA 4.0; a quotation that NOTICE.md (opens in a new tab) allows or keeps under its transition clause keeps its source licence and is not relicensed under CC BY-SA 4.0.

Framework, 1

Frameworks

Supplier and Cloud Governance Frameworkv1.0.1

Standard, 3

Standards

Cloud Exit and Data Portability Standardv1.2.12
Supplier Resilience Monitoring Standardv1.0.12
Supplier Security and Privacy Assurance Standardv1.1.15

Procedure, 7

Procedures

Fourth-Party and Nth-Party Risk Procedurev1.0.18
Supplier Audit Procedurev1.0.23
Supplier Due Diligence Procedurev1.1.17
Supplier Exit and Data Return Procedurev1.0.7
Supplier Onboarding Security Review Procedurev1.0.10
Supplier Ongoing Monitoring Procedurev1.0.6
Third-Party AI Due Diligence Procedurev1.0.28

Matrix, 1

Matrices

Supply Chain Security Programme Alignment Matrixv1.0.16

Registers

Concentration Risk Registerv1.0.23
Software Bill of Materials Registerv1.0.8
Subprocessor Register Templatev1.0.6
Supplier Risk Register Templatev1.0.4

Template, 2

Templates

Supplier Offboarding Evidence Templatev1.0.15
Supplier Security Questionnairev1.0.8

Annex, 1

Annexes

Trade and Supply-Chain Continuity Controls Annexv1.0.1

Leadership, 9

Leadership pages for this area

Pages from the executive layer that tag this area. They explain and advise; the documents above govern.

Choosing how much cloud and supplier concentration to accept and what exit readiness to maintaindecision narrative
What the governing body should require before an AI system goes into productionexecutive brief
What the governing body should require for AI resilience and continuityexecutive brief
What the governing body should require for third-party and AI supply-chain risk oversightexecutive brief
From AI idea to retirement: the governed life of an AI systemjourney
From retention rule to destruction evidence: the governed journey of a recordjourney
What the governing body should ask about the organization's AI inventory, risks, incidents, suppliers, and changeoversight question set
What happens when a critical AI supplier failsscenario
When a customer-data service must move after its legal operating boundary changesscenario

Next on the tour

Open a domain: Dev security