{ "schemaVersion": "artifactExample.v2", "artifactId": "SSAQ", "title": "Supplier Security Assessment Questionnaire", "definitionRef": { "artifactId": "SSAQ", "definitionSchemaVersion": "artifactDefinition.v2", "definitionId": "SSAQ.artifactDefinition.v2", "title": "Supplier Security Assessment Questionnaire" }, "organization": "Arcfield", "sections": [ { "id": "title_page", "title": "Title Page", "values": { "Form Title": "Supplier Security Assessment Questionnaire", "Form ID": "SSAQ-FRM-001", "Version": "1.1", "Status": "Approved", "Organization": "Arcfield", "Owner": "Supplier Manager", "Approver": "ISMS Manager", "Classification": "Internal", "Effective Date": "2026-09-11", "Next Review Date": "2027-09-11" }, "items": [ "Form Title: Supplier Security Assessment Questionnaire", "Form ID: SSAQ-FRM-001", "Version: 1.1", "Status: Approved", "Organization: Arcfield", "Owner: Supplier Manager", "Approver: ISMS Manager", "Classification: Internal", "Effective Date: 2026-09-11", "Next Review Date: 2027-09-11" ], "contentType": "metadata" }, { "id": "abstract", "title": "Abstract", "text": "This example shows a supplier security assessment for a SaaS provider used by support operations. It demonstrates evidence-based answers, conditional approval and follow-up actions for access-review and continuity evidence. This form is the operating template used with Arcfield Platform freeze records in the surveillance cycle after certificate ARC-ISMS-2025-001.", "contentType": "narrative" }, { "id": "document_control", "title": "Document Control", "contentType": "control_table" }, { "id": "change_log", "title": "Revision history", "groups": [ { "text": "A published change is a new row. Do not edit an approved version in place." }, { "rows": [ { "Version": "1.0", "Date": "2026-08-29", "Change": "Initial Arcfield Platform publication.", "Approved by": "ISMS Manager" }, { "Version": "1.1", "Date": "2026-09-11", "Change": "Approved Arcfield worked example after the 11 September 2026 internal audit.", "Approved by": "ISMS Manager" } ] } ], "contentType": "revision_table" }, { "id": "instructions", "title": "Instructions", "groups": [ { "text": "Copy this file as the controlled Word master for your ISMS. The Arcfield identity fields on the cover are the approved worked example. Complete the steps below when you adopt the file for your organization." }, { "items": [ "Fill the cover identity fields (Organization, Version, Classification, Owner, Approver, Effective Date and Next Review Date) when you adopt this file. The Arcfield values shown here are the approved worked example.", "Issue your own version and a new Revision history row. Do not edit an approved version in place.", "Cite this approved version from related records. Do not copy this file into those records." ] } ], "contentType": "ordered_list" }, { "id": "form_schema", "title": "Form schema", "fields": [ "Assessment ID", "Supplier Legal Name", "Supplier Type", "Service Provided", "Service Owner", "Supplier Criticality", "Data Access", "Assessment Date", "Assessor Role", "Overall Risk Rating", "Status" ], "questions": [ "Governance", "Certification", "Access Control", "Data Protection", "Incident Management", "Continuity", "Subprocessors" ], "groups": [ { "id": "worked_example", "heading": "Worked example", "level": 1, "text": "Use this worked record. Keep one accountable owner per row and cite this Document Control version from the live register.", "rows": [ { "Field": "Assessment ID", "Type": "text", "Required": "yes", "Description": "Unique assessment reference.", "Example": "SSAQ-2026-CLOUDDESK-001" }, { "Field": "Supplier Legal Name", "Type": "text", "Required": "yes", "Description": "Legal supplier name.", "Example": "CloudDesk Services Ltd." }, { "Field": "Supplier Type", "Type": "select", "Required": "yes", "Description": "SaaS, professional service, infrastructure, software or other.", "Example": "SaaS provider" }, { "Field": "Service Provided", "Type": "text", "Required": "yes", "Description": "Supplier service.", "Example": "Support ticketing platform" }, { "Field": "Service Owner", "Type": "text", "Required": "yes", "Description": "Arcfield owner.", "Example": "Support Operations Manager" }, { "Field": "Supplier Criticality", "Type": "select", "Required": "yes", "Description": "Standard, important or critical.", "Example": "Important" }, { "Field": "Data Access", "Type": "text", "Required": "yes", "Description": "Data processed or accessed.", "Example": "Customer support data" }, { "Field": "Assessment Date", "Type": "date", "Required": "yes", "Description": "Assessment date.", "Example": "2026-08-29" }, { "Field": "Assessor Role", "Type": "text", "Required": "yes", "Description": "Role completing assessment.", "Example": "Supplier Manager" }, { "Field": "Overall Risk Rating", "Type": "select", "Required": "yes", "Description": "Low, medium or high.", "Example": "Medium" }, { "Field": "Status", "Type": "select", "Required": "yes", "Description": "Approved, approved with conditions, rejected or further review.", "Example": "Approved with conditions" } ] } ], "contentType": "form_schema" }, { "id": "form_responses", "title": "Form responses", "schemaRef": { "definitionId": "SSAQ.artifactDefinition.v2", "sectionId": "form_responses" }, "values": { "Assessment ID": "SSAQ-2026-CLOUDDESK-001", "Supplier Legal Name": "CloudDesk Services Ltd.", "Supplier Type": "SaaS provider", "Service Provided": "Customer support ticketing platform", "Service Owner": "Support Operations Manager", "Supplier Criticality": "Important", "Data Access": "Customer support data", "Assessment Date": "2026-08-29", "Assessor Role": "Supplier Manager", "Overall Risk Rating": "Medium", "Status": "Approved with conditions" }, "answers": [ { "Question ID": "SSAQ-Q001", "Area": "Governance", "Question": "Does the supplier maintain approved information security policies?", "Response": "Yes", "Evidence Reference": "CLOUDDESK-SEC-OVERVIEW-2026", "Follow-up Required": "No", "Notes": "Security overview reviewed." }, { "Question ID": "SSAQ-Q002", "Area": "Certification", "Question": "Does the supplier hold ISO 27001, SOC 2, or equivalent assurance?", "Response": "Yes", "Evidence Reference": "CLOUDDESK-SOC2-2026", "Follow-up Required": "No", "Notes": "SOC 2 Type II report current." }, { "Question ID": "SSAQ-Q003", "Area": "Access Control", "Question": "Are access rights reviewed periodically?", "Response": "Partial", "Evidence Reference": "CLOUDDESK-ACCESS-FAQ-2026", "Follow-up Required": "Yes", "Notes": "Review cadence documented, evidence export requested." }, { "Question ID": "SSAQ-Q004", "Area": "Data Protection", "Question": "Are data protection and privacy requirements addressed contractually?", "Response": "Yes", "Evidence Reference": "DPA-CLOUDDESK-2026", "Follow-up Required": "No", "Notes": "DPA and subprocessor list available." }, { "Question ID": "SSAQ-Q005", "Area": "Incident Management", "Question": "Are incidents reported within agreed timelines?", "Response": "Yes", "Evidence Reference": "CLOUDDESK-MSA-SEC-2026", "Follow-up Required": "No", "Notes": "Notification route defined." }, { "Question ID": "SSAQ-Q006", "Area": "Continuity", "Question": "Are continuity and recovery capabilities tested?", "Response": "Partial", "Evidence Reference": "CLOUDDESK-BCP-SUMMARY-2026", "Follow-up Required": "Yes", "Notes": "Latest restore-test summary requested." }, { "Question ID": "SSAQ-Q007", "Area": "Subprocessors", "Question": "Are subprocessors disclosed and controlled?", "Response": "Yes", "Evidence Reference": "CLOUDDESK-SUBPROCESSORS-2026", "Follow-up Required": "No", "Notes": "Notification mechanism active." } ], "groups": [ { "id": "introduction", "heading": "What this form is", "level": 1, "text": "This document is Arcfield's Supplier Security Assessment Questionnaire. Assess supplier security posture before onboarding and during periodic review. It is not a methodology essay or the governing policy. This form applies to the Arcfield Platform (B2B SaaS for regulated fintech and health customers): production, customer data, CI/CD, privileged access and critical suppliers. Neighbouring records (ISO, SINV, BCP) cite this Document Control version. Do not copy these paragraphs into them." }, { "id": "scope", "heading": "Scope", "level": 1, "text": "Use this table before you copy a rule into another record or exclude a duty from this file.", "rows": [ { "In this file": "The rules, roles, worked Arcfield example and the records this file owns.", "Not in this file": "The ISMS boundary (ISS), Annex A selection (SoA) or live rows in ISO, SINV, BCP." }, { "In this file": "Interfaces that must cite this Document Control version, including CI/CD, identity and suppliers where they affect CIA.", "Not in this file": "Live ISS scope rows, SoA applicability decisions, or neighbouring live registers. Those files keep their own approved versions; this file does not duplicate them." } ] }, { "id": "terms", "heading": "Terms used here", "level": 1, "text": "These terms are local to this file. Expand every acronym on first use in the body.", "rows": [ { "Term": "Check ID", "Meaning": "The stable identifier for one check or question. Do not reuse an ID for a different question." }, { "Term": "Exception", "Meaning": "A time-bound, approved departure with expiry and a compensating control." }, { "Term": "CIA", "Meaning": "Confidentiality, Integrity and Availability of in-scope information and services." }, { "Term": "Document Control version", "Meaning": "The approved version cited from neighbouring records. Do not copy this body into those records." } ] }, { "id": "evidence_and_attachments", "heading": "Evidence and attachments", "level": 1, "rows": [ { "Evidence ID": "SSAQ-EV-001", "Evidence Type": "Assurance report", "Description": "SOC 2 Type II report for CloudDesk service.", "Owner": "Supplier Manager", "Evidence Reference": "CLOUDDESK-SOC2-2026", "Retention Note": "Retain with supplier file." }, { "Evidence ID": "SSAQ-EV-002", "Evidence Type": "Contract evidence", "Description": "DPA and security schedule.", "Owner": "Legal Counsel", "Evidence Reference": "DPA-CLOUDDESK-2026", "Retention Note": "Retain for supplier relationship period." }, { "Evidence ID": "SSAQ-EV-003", "Evidence Type": "Follow-up request", "Description": "Request for access-review and restore-test evidence.", "Owner": "Supplier Manager", "Evidence Reference": "SINV-CLOUDDESK-FU-2026-Q3", "Retention Note": "Close before next review." } ] }, { "id": "review_and_decision", "heading": "Review and decision", "level": 1, "rows": [ { "Field": "Decision", "Value": "Approved with conditions" }, { "Field": "Risk Rating", "Value": "Medium" }, { "Field": "Approval Conditions", "Value": "Supplier must provide access-review export and latest restore-test evidence." }, { "Field": "Required Actions", "Value": "Track two follow-up evidence requests in supplier inventory." }, { "Field": "Owner Role", "Value": "Supplier Manager" }, { "Field": "Target Date", "Value": "2026-09-15" }, { "Field": "Reviewed by", "Value": "ISMS Manager" }, { "Field": "Decision date", "Value": "2026-08-29" }, { "Field": "Evidence reference", "Value": "SSAQ-2026-CLOUDDESK-001" } ] } ], "contentType": "form_response" }, { "id": "evidence_and_attachments", "title": "Evidence and attachments", "schemaRef": { "definitionId": "SSAQ.artifactDefinition.v2", "sectionId": "evidence_and_attachments", "fieldsRef": "sections.evidence_and_attachments.fields" }, "groups": [ {}, { "rows": [ { "Evidence ID": "SSAQ-EV-001", "Evidence Type": "Assurance report", "Description": "SOC 2 Type II report for CloudDesk service.", "Owner": "Supplier Manager", "Evidence Reference": "CLOUDDESK-SOC2-2026", "Retention Note": "Retain with supplier file." }, { "Evidence ID": "SSAQ-EV-002", "Evidence Type": "Contract evidence", "Description": "DPA and security schedule.", "Owner": "Legal Counsel", "Evidence Reference": "DPA-CLOUDDESK-2026", "Retention Note": "Retain for supplier relationship period." }, { "Evidence ID": "SSAQ-EV-003", "Evidence Type": "Follow-up request", "Description": "Request for access-review and restore-test evidence.", "Owner": "Supplier Manager", "Evidence Reference": "SINV-CLOUDDESK-FU-2026-Q3", "Retention Note": "Close before next review." } ] } ], "contentType": "evidence_table" }, { "id": "review_and_decision", "title": "Review and decision", "values": { "Decision": "Approved with conditions", "Risk Rating": "Medium", "Approval Conditions": "Supplier must provide access-review export and latest restore-test evidence.", "Required Actions": "Track two follow-up evidence requests in supplier inventory.", "Owner Role": "Supplier Manager", "Target Date": "2026-09-15", "Reviewed by": "ISMS Manager", "Decision date": "2026-08-29", "Evidence reference": "SSAQ-2026-CLOUDDESK-001" }, "groups": [ {}, { "rows": [ { "Field": "Decision", "Value": "Approved with conditions" }, { "Field": "Risk Rating", "Value": "Medium" }, { "Field": "Approval Conditions", "Value": "Supplier must provide access-review export and latest restore-test evidence." }, { "Field": "Required Actions", "Value": "Track two follow-up evidence requests in supplier inventory." }, { "Field": "Owner Role", "Value": "Supplier Manager" }, { "Field": "Target Date", "Value": "2026-09-15" }, { "Field": "Reviewed by", "Value": "ISMS Manager" }, { "Field": "Decision date", "Value": "2026-08-29" }, { "Field": "Evidence reference", "Value": "SSAQ-2026-CLOUDDESK-001" } ] } ], "contentType": "decision_table" }, { "id": "external_references", "title": "References", "groups": [ { "text": "Cite these sources from workshops and audits. This list names ISO clauses, book chapters and companion artifacts used by this file." }, { "rows": [ { "Kind": "ISO", "Reference": "ISO/IEC 27001:2022", "How this document uses it": "Normative ISMS requirements this companion artifact supports.", "href": "https://www.iso.org/standard/82875.html" }, { "Kind": "Book", "Reference": "Building the ISMS, HR Security: Screening, Onboarding & Offboarding", "How this document uses it": "Primary operating chapter for this companion artifact.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "BCP Business Continuity Plan (BCP) (Building the ISMS, Business Continuity & Disaster Recovery)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "ISO Information Security Objectives (Building the ISMS, Information Security Policies & Risk Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" }, { "Kind": "Artifact", "Reference": "SINV Supplier Inventory (Building the ISMS, Supplier Security & Third-party Risk Management)", "How this document uses it": "Interface record. Cite this Document Control version; do not copy this file into that record.", "href": "https://www.amazon.com/dp/9789908983448" } ], "text": "Use this table or list as the working record. Name owners, systems and evidence so a second person can apply the same rule." } ], "contentType": "reference_table" } ], "enrichment": { "source": "Example.json", "method": "curated-json", "note": "Completes Example JSON with renderer-native sections and generalized groups; no mdSource helper fields." }, "snapshotRef": { "snapshotId": "arcfield.platform.surv.2026-09-11", "schemaVersion": "evidenceSnapshot.v1" }, "scenarioRef": { "githubIssue": 64, "crId": "CR-TYPE-ARCFIELD-001", "family": "Form", "role": "Blank operating form used with freeze records" } }