Inclusion of Third Parties in Training Programmes
This document defines a practical and verifiable approach to ensure that external suppliers, contractors and outsourcing are properly integrated into the security training programmes before they obtain technical access to projects, systems or sensitive data.
🎯 Objective
- Standardise the training criteria for external parties with a technical impact
- Avoid security disparities between internal and external teams
- Ensure traceability and accountability in audits and post-incident
- Formalise training as a precondition for technical access
✅ Minimum applicable requirements
Every third party (individual or organisation) must fulfil the following points before obtaining technical permissions:
| Requirement | Mandatory? |
|---|---|
| Signature of a statement of responsibility (may be digital) | ✔️ |
| Formal assignment of a training track according to the technical role | ✔️ |
| Completion and validation of the training (e.g. quiz, validated PR) | ✔️ |
| Training record in a validated repository (project, LMS, GitHub, etc.) | ✔️ |
| Integration session with an internal member (e.g. AppSec, PO, Champion) | ✔️ |
🧩 Practical arrangements by type of third party
| Type of third party | Suggested training arrangement | Expected record |
|---|---|---|
| Individual contractor | Technical track + online quiz + PR validation | Checkpoint in onboarding |
| Supplier with a team | Synchronous session + shared content (LMS, internal repository) | Attendance list + evidence per user |
| Continuous outsourcing | Formal training with a contractual clause + control by SLA | Contract + LMS logs |
🧭 Good implementation practices
- Include a reference to Chapter 13 - Training in the contracting process
- Formalise the requirements via Chapter 14 - Governance and Contracting
- Maintain an internal repository of evidence of third-party onboarding
- Ensure that the Champions or AppSec are involved in receiving third parties
- Provide for periodic audits of training at critical suppliers
🔗 Links to other documents
| Document | Relevance |
|---|---|
03-checklist-onboarding.md | Also applicable to third parties with technical access |
trilho-formativo.md | Defines the tracks to apply per role |
14-governanca-contratacao.md | Formalises the requirements via contractual clauses |
🔐 Ensuring that third parties are trained is not a courtesy - it is an organisational security obligation.
The application of this model contributes directly to reducing supply chain risks and exposure through poor external practice.