{ "schemaVersion": "artifactDefinition.v2", "definitionId": "SINV.artifactDefinition.v2", "artifactId": "SINV", "title": "Supplier Inventory", "artifactType": "Inventory", "format": "xlsx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable register maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example data fixture" }, "purpose": "Define the required structure for maintaining a security-relevant supplier inventory with tiering, due diligence, contract controls, subprocessor visibility, exit planning, ownership, review cadence and evidence.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use SINV to keep supplier security responsibilities, evidence and review obligations visible before onboarding, renewal and audit.", "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Critical suppliers need stronger evidence: due diligence, contract security terms, subprocessor visibility and exit planning.", "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk" }, "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below." }, { "order": 5, "id": "supplier_inventory", "title": "Supplier inventory", "contentType": "register_table", "required": true, "minimumExampleRows": 6, "columns": [ { "name": "Supplier ID", "type": "text", "required": "yes", "description": "Unique supplier identifier.", "example": "SINV-001" }, { "name": "Supplier Name", "type": "text", "required": "yes", "description": "Supplier legal or service name.", "example": "CloudHost Analytics" }, { "name": "Service", "type": "text", "required": "yes", "description": "Service provided.", "example": "Hosted analytics platform" }, { "name": "Owner", "type": "select", "required": "yes", "description": "Accountable internal owner.", "example": "Supplier Manager", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Supplier Tier", "type": "select", "required": "yes", "description": "Tier based on risk and dependency.", "example": "Tier 1" }, { "name": "Criticality", "type": "select", "required": "yes", "description": "Business or ISMS criticality.", "example": "Critical" }, { "name": "Data or Assets Accessed", "type": "text", "required": "yes", "description": "Data, systems or assets the supplier can access.", "example": "Customer metadata" }, { "name": "Personal Data", "type": "text", "required": "yes", "description": "Whether personal data is involved.", "example": "Limited customer contact metadata" }, { "name": "Due Diligence Status", "type": "select", "required": "yes", "description": "Current, action open, pilot, overdue or not applicable.", "example": "Current" }, { "name": "Contract Security Schedule", "type": "text", "required": "yes", "description": "Contractual security status.", "example": "Security schedule approved" }, { "name": "Subprocessors", "type": "text", "required": "yes", "description": "Subprocessor review status.", "example": "Reviewed quarterly" }, { "name": "Exit Plan", "type": "text", "required": "yes", "description": "Exit or migration approach.", "example": "Export data and migrate dashboards" }, { "name": "Review Cadence", "type": "text", "required": "yes", "description": "Review frequency.", "example": "Quarterly" }, { "name": "Next Review Date", "type": "date", "required": "yes", "description": "Next planned supplier review.", "example": "2026-09-10" }, { "name": "Status", "type": "select", "required": "yes", "description": "Active, pilot, action open or retired.", "example": "Active", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes", "description": "Evidence record.", "example": "SINV-CLOUDHOST-2026-Q3" }, { "name": "Notes", "type": "text", "required": "no", "description": "Additional context.", "example": "Linked to LRR-005." } ], "hint": { "text": "Each supplier row should show business dependency, data exposure, review status, contractual safeguards and evidence.", "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk" } }, { "order": 6, "id": "supplier_review_decision", "title": "Supplier review decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Review result", "type": "select", "required": "yes", "valueSet": "domain.reviewResult", "options": [ "Pass", "Pass with observations", "Fail", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Suppliers reviewed", "type": "text", "required": "yes" }, { "name": "Critical suppliers", "type": "text", "required": "yes" }, { "name": "Open supplier actions", "type": "text", "required": "yes" }, { "name": "Next review focus", "type": "text", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a review decision so supplier evidence gaps become actions instead of hidden audit risk.", "bookReference": "Volume 1, S-02-02-00 Supplier Security & Third-Party Risk" } }, { "order": 7, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true } ], "validationRules": [ "JSON Example must contain definitionRef pointing to SINV.artifactDefinition.v2.", "JSON Example register sections must contain schemaRef pointing to the matching definition section.", "Supplier rows must include tier, criticality, data or asset access, due diligence status, contract security schedule, subprocessor status, exit plan, owner, next review date and evidence reference.", "Critical suppliers must have a review cadence, exit plan and current evidence reference.", "Body must render the contract schema and the example data.", "No standalone Book reference section and no generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." }, { "label": "ISO/IEC 27001:2022 8.1", "href": "https://www.iso.org/standard/82875.html", "role": "Operational planning and control this register evidences." }, { "label": "ISO/IEC 27001:2022 7.5", "href": "https://www.iso.org/standard/82875.html", "role": "Documented information: identify, review and cite this workbook by version." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-02-02-00", "chapterTitle": "Supplier Security & Third-Party Risk", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "DNS", "longForm": "Domain Name System" }, { "abbr": "DPA", "longForm": "Data Processing Agreement" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MFA", "longForm": "Multi-Factor Authentication" }, { "abbr": "SLA", "longForm": "Service Level Agreement" } ], "must": [ "Keep one live row per record on Working sheets. Do not merge several cases into one row.", "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example." ], "mustNot": [ "Do not invent live rows in the renderer. Example data lives in the Example JSON.", "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register." ], "exampleWorkbook": { "workedExampleOrg": "Arcfield", "requiredSheets": [ "supplier_inventory", "supplier_review_decision" ], "minExampleRows": 6, "coverFromExample": true } }, "editorialContractId": "editorial.xlsx.register.v1", "contentContractId": "content.register.inventory.v1" }