{ "schemaVersion": "artifactDefinition.v2", "definitionId": "CSSAQ.artifactDefinition.v2", "artifactId": "CSSAQ", "title": "Critical Supplier Security Assessment Questionnaire", "artifactType": "Form", "format": "docx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable form maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example response fixture" }, "purpose": "Assess critical suppliers against information security and compliance expectations before onboarding and during periodic review.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use CSSAQ for critical suppliers where assurance must go deeper than the standard supplier questionnaire.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Critical suppliers need evidence-backed answers, explicit exceptions and accountable follow-up actions before approval.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 6, "id": "form_schema", "title": "Form schema", "contentType": "form_schema", "required": true, "fields": [ { "name": "Assessment ID", "type": "text", "required": "yes" }, { "name": "Supplier Legal Name", "type": "text", "required": "yes" }, { "name": "Supplier Type", "type": "text", "required": "yes" }, { "name": "Country or Region", "type": "text", "required": "yes" }, { "name": "Service Provided", "type": "text", "required": "yes" }, { "name": "Arcfield Business Owner", "type": "text", "required": "yes" }, { "name": "Supplier Criticality", "type": "text", "required": "yes" }, { "name": "Data Processed", "type": "text", "required": "yes" }, { "name": "Security Contact Role", "type": "text", "required": "yes" }, { "name": "Assessment Date", "type": "date", "required": "yes" }, { "name": "Assessor Role", "type": "text", "required": "yes" }, { "name": "Overall Assessment", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "questionGroups": [ "Certifications and Compliance", "Information Security Governance", "Access Control and Endpoint Security", "Data Protection", "Backup Continuity and Incident Management", "Subcontractors" ], "hint": { "text": "Structure the form so criticality, data exposure, assurance evidence and supplier commitments are visible at review time.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 7, "id": "form_responses", "title": "Form responses", "contentType": "form_response", "required": true, "hint": { "text": "Responses should support an approval decision, not just collect answers; each weak answer needs evidence or follow-up.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 8, "id": "evidence_and_attachments", "title": "Evidence and attachments", "contentType": "evidence_table", "required": true, "fields": [ { "name": "Evidence ID", "type": "text", "required": "yes" }, { "name": "Evidence Type", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes" }, { "name": "Retention Note", "type": "text", "required": "yes" } ], "hint": { "text": "Attach the assurance evidence that proves certifications, controls, data protection, continuity and incident commitments.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 9, "id": "review_and_decision", "title": "Review and decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Decision", "type": "text", "required": "yes" }, { "name": "Risk Rating", "type": "text", "required": "yes" }, { "name": "Approval Conditions", "type": "text", "required": "yes" }, { "name": "Required Follow-up Actions", "type": "text", "required": "yes" }, { "name": "Owner Role", "type": "text", "required": "yes" }, { "name": "Target Date", "type": "date", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a documented decision so critical supplier conditions and residual risks remain visible.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 10, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } } ], "validationRules": [ "JSON Example must contain definitionRef pointing to CSSAQ.artifactDefinition.v2.", "JSON Example form sections must contain schemaRef pointing to the matching definition section.", "Form responses must include supplier profile, criticality, data processed, assurance answers, evidence references, risk rating and approval decision.", "Any Partial or No answer must include follow-up notes or required actions.", "Critical suppliers must include subcontractor, continuity and incident-management assessment evidence.", "Body must render the contract schema and example responses.", "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 A.5.19", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.20", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.21", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.22", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-03-02-00", "chapterTitle": "HR Security: Screening, Onboarding & Offboarding", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Assess critical suppliers against information security and compliance expectations before onboarding and during periodic review.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "BCP", "longForm": "Business Continuity Plan" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "DPA", "longForm": "Data Processing Agreement" }, { "abbr": "EV", "longForm": "Extended Validation" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "IAM", "longForm": "Identity and Access Management" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "MSA", "longForm": "Master Services Agreement" }, { "abbr": "RPO", "longForm": "Recovery Point Objective" }, { "abbr": "RTO", "longForm": "Recovery Time Objective" }, { "abbr": "SOC", "longForm": "Security Operations Center" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "This file's function is: Assess critical suppliers against information security and compliance expectations before onboarding and during periodic review. It must not be rewritten as a generic operating-rules essay.", "Complete one questionnaire per critical supplier.", "Record supplier identity, service scope, criticality and data processed.", "Answer each assurance question with evidence reference and follow-up status.", "Include subcontractor, continuity and incident-notification evidence.", "Capture required documentation and open exceptions.", "Close with risk rating, approval decision, conditions, owner and target date." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "form_responses", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this form is", "mustInclude": [ "form" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "evidence_and_attachments", "heading": "Evidence and attachments", "mustInclude": [ "Evidence", "attachments" ] }, { "id": "review_and_decision", "heading": "Review and decision", "mustInclude": [ "Review", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.form.v1", "contentContractId": "content.form.v1" }