{ "schemaVersion": "artifactDefinition.v2", "definitionId": "SSAQ.artifactDefinition.v2", "artifactId": "SSAQ", "title": "Supplier Security Assessment Questionnaire", "artifactType": "Form", "format": "docx", "productTier": "Premium", "definitionRole": "contract", "sourceModel": { "body": "canonical human-readable form maintained in the Artifact Candidate page", "jsonDefinition": "machine-readable contract and validation model", "jsonExample": "curated realistic example response fixture" }, "purpose": "Assess supplier security posture before onboarding and during periodic review.", "sections": [ { "order": 1, "id": "title_page", "title": "Title Page", "contentType": "metadata", "required": true, "hint": null }, { "order": 2, "id": "abstract", "title": "Abstract", "contentType": "narrative", "required": true, "hint": { "text": "Use SSAQ before onboarding or reassessment so supplier risks, evidence and approval conditions are documented consistently.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 3, "id": "document_control", "title": "Document Control", "contentType": "control_table", "required": true, "hint": null }, { "order": 4, "id": "change_log", "title": "Revision history", "contentType": "revision_table", "required": true }, { "order": 5, "id": "instructions", "title": "Instructions", "contentType": "ordered_list", "required": true, "hint": { "text": "Keep questionnaire answers evidence-based: Yes without evidence should still trigger follow-up.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 6, "id": "form_schema", "title": "Form schema", "contentType": "form_schema", "required": true, "fields": [ { "name": "Assessment ID", "type": "text", "required": "yes" }, { "name": "Supplier Legal Name", "type": "text", "required": "yes" }, { "name": "Supplier Type", "type": "text", "required": "yes" }, { "name": "Service Provided", "type": "text", "required": "yes" }, { "name": "Service Owner", "type": "text", "required": "yes" }, { "name": "Supplier Criticality", "type": "text", "required": "yes" }, { "name": "Data Access", "type": "text", "required": "yes" }, { "name": "Assessment Date", "type": "date", "required": "yes" }, { "name": "Assessor Role", "type": "text", "required": "yes" }, { "name": "Overall Risk Rating", "type": "text", "required": "yes" }, { "name": "Status", "type": "select", "required": "yes", "valueSet": "domain.status.generic", "options": [ "Draft", "In Progress", "Under Review", "Approved", "Closed", "Deferred" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } } ], "questions": [ "Governance", "Certification", "Access Control", "Data Protection", "Incident Management", "Continuity", "Subprocessors" ], "hint": { "text": "Define profile fields and questionnaire topics so each supplier assessment is comparable across risk tiers.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 7, "id": "form_responses", "title": "Form responses", "contentType": "form_response", "required": true, "hint": { "text": "A complete response includes supplier context, question answers, evidence references, risk rating and approval conditions.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 8, "id": "evidence_and_attachments", "title": "Evidence and attachments", "contentType": "evidence_table", "required": true, "fields": [ { "name": "Evidence ID", "type": "text", "required": "yes" }, { "name": "Evidence Type", "type": "text", "required": "yes" }, { "name": "Description", "type": "text", "required": "yes" }, { "name": "Owner", "type": "select", "required": "yes", "valueSet": "domain.owner", "options": [ "ISMS Manager", "Control Owner", "Risk Owner", "Process Owner", "Asset Owner", "IT Security", "HR", "Legal", "Executive Management", "Internal Audit" ], "validation": { "allowBlank": false, "errorTitle": "Invalid value", "error": "Select a value from the list." } }, { "name": "Evidence Reference", "type": "text", "required": "yes" }, { "name": "Retention Note", "type": "text", "required": "yes" } ], "hint": { "text": "Attach certificates, assurance reports, security overviews and contractual evidence needed to support the decision.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 9, "id": "review_and_decision", "title": "Review and decision", "contentType": "decision_table", "required": true, "fields": [ { "name": "Decision", "type": "text", "required": "yes" }, { "name": "Risk Rating", "type": "text", "required": "yes" }, { "name": "Approval Conditions", "type": "text", "required": "yes" }, { "name": "Required Actions", "type": "text", "required": "yes" }, { "name": "Owner Role", "type": "text", "required": "yes" }, { "name": "Target Date", "type": "date", "required": "yes" }, { "name": "Reviewed by", "type": "text", "required": "yes" }, { "name": "Decision date", "type": "date", "required": "yes" }, { "name": "Evidence reference", "type": "text", "required": "yes" } ], "hint": { "text": "Close with a decision so supplier approval conditions and follow-up actions remain visible.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } }, { "order": 10, "id": "external_references", "title": "References", "contentType": "reference_table", "required": true, "hint": { "text": "Apply References with named owners, systems and exportable evidence. Do not leave this chapter as a heading plus a bare table.", "bookReference": "Volume 1, S-03-02-00 HR Security Screening, Onboarding & O" } } ], "validationRules": [ "JSON Example must contain definitionRef pointing to SSAQ.artifactDefinition.v2.", "JSON Example form sections must contain schemaRef pointing to the matching definition section.", "Form responses must include supplier profile, questionnaire answers, evidence references, risk rating and decision.", "Any Partial or No answer must include follow-up notes or required actions.", "Body must render the contract schema and example responses.", "No standalone Book reference section, mdDefinition, mdExample or generic Sample placeholders are allowed." ], "enrichment": { "source": "Contract.json", "method": "curated-json", "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects." }, "editorialStandard": { "isoAnchors": [ { "label": "ISO/IEC 27001:2022 A.5.19", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.20", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.21", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022 A.5.22", "href": "https://www.iso.org/standard/82875.html", "role": "Annex A control this artifact implements." }, { "label": "ISO/IEC 27001:2022", "href": "https://www.iso.org/standard/82875.html", "role": "Normative source this artifact implements or cites." } ], "bookSources": [ { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-03-02-00", "chapterTitle": "HR Security: Screening, Onboarding & Offboarding", "primary": true, "role": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "series": "ISO 27001 for Software Companies", "volume": 1, "volumeTitle": "Building the ISMS", "chapterId": "S-00-03-00", "chapterTitle": "Planning, Risk & Objectives (Clause 6)", "primary": false, "role": "Documented information, review and version discipline.", "href": "https://www.amazon.com/dp/9789908983448" } ], "purpose": "Assess supplier security posture before onboarding and during periodic review.", "requiredEditorialElements": [ "introduction as purpose prose", "scope of this document versus neighbouring records", "terms as a first-class group", "worked Arcfield example", "practical examples, pitfalls, evidence and external references" ], "acronyms": [ { "abbr": "ISMS", "longForm": "Information Security Management System" }, { "abbr": "SaaS", "longForm": "Software as a Service" }, { "abbr": "CIA", "longForm": "Confidentiality, Integrity, and Availability" }, { "abbr": "CI/CD", "longForm": "Continuous Integration / Continuous Delivery" }, { "abbr": "ISO", "longForm": "International Organization for Standardization" }, { "abbr": "BCP", "longForm": "Business Continuity Plan" }, { "abbr": "CI", "longForm": "Continuous Integration" }, { "abbr": "CD", "longForm": "Continuous Delivery" }, { "abbr": "DPA", "longForm": "Data Processing Agreement" }, { "abbr": "EV", "longForm": "Extended Validation" }, { "abbr": "FAQ", "longForm": "Frequently Asked Questions" }, { "abbr": "HR", "longForm": "Human Resources" }, { "abbr": "JSON", "longForm": "JavaScript Object Notation" }, { "abbr": "MSA", "longForm": "Master Services Agreement" }, { "abbr": "SOC", "longForm": "Security Operations Center" }, { "abbr": "SoA", "longForm": "Statement of Applicability" } ], "must": [ "This file's function is: Assess supplier security posture before onboarding and during periodic review. It must not be rewritten as a generic operating-rules essay.", "Complete one form per supplier assessment or reassessment.", "Record supplier profile, service scope, criticality and data access.", "Answer each questionnaire item using evidence-based responses.", "Add evidence references for every Yes or Partial answer.", "Capture follow-up notes for Partial or No answers.", "Close with risk rating, decision, conditions and owner." ], "mustNot": [ "Do not replace this artifact's function with a shared family skeleton (operating_rules, systems_and_records)." ], "softwareCompanyAdaptations": [ "Use Arcfield as the worked example (cover variant A).", "Name SaaS, cloud, CI/CD, privileged access or supplier interfaces where they affect this artifact's function." ], "exampleBody": { "sectionId": "form_responses", "workedExampleOrg": "Arcfield", "minBodyWords": 150, "requiredGroups": [ { "id": "introduction", "heading": "What this form is", "mustInclude": [ "form" ] }, { "id": "scope", "heading": "Scope", "mustInclude": [ "Scope" ] }, { "id": "terms", "heading": "Terms used here", "mustInclude": [ "Terms" ] }, { "id": "evidence_and_attachments", "heading": "Evidence and attachments", "mustInclude": [ "Evidence", "attachments" ] }, { "id": "review_and_decision", "heading": "Review and decision", "mustInclude": [ "Review", "decision" ] } ], "requiredSections": [ { "id": "change_log", "title": "Revision history", "role": "Versioned freeze log with how-to sentence and rows Version, Date, Change, Approved by. Last Version matches title_page.values.Version." }, { "id": "external_references", "title": "References", "role": "ISO clauses, book chapters and companion artifacts. Not a series catalogue." } ] } }, "editorialContractId": "editorial.docx.form.v1", "contentContractId": "content.form.v1" }