Minimum Training for Third Parties and Suppliers
This document defines the minimum mandatory content of security upskilling for all external staff with relevant technical access - including suppliers, contractors and external teams - ensuring traceability and formal validation before permissions are assigned.
🎯 Objective
- Ensure that third parties meet the same minimum security criteria as internal staff
- Ensure formal validation of the applied knowledge
- Reduce the risk of error, exposure or improper access through lack of knowledge
- Standardise the training requirement in contractual and operational processes
🧭 Scope of application
This model applies to:
- Service providers with access to code, infrastructure or sensitive data
- Consultants, freelancers or contractors who are technically integrated
- Suppliers with continuous access (e.g. via VPN, GitHub, ADO, bastion)
- External teams integrated into internal squads, SCRUMs or DevOps
📋 Minimum mandatory content
| Topic | Description | Suggested format |
|---|---|---|
| Internal security policy | Rules, expected behaviours, formal channels | Institutional PDF or short video |
| Secure PR | Minimum submission standards, positive and negative examples | Guide + practical quiz |
| Secrets management | What must not be submitted (e.g. .env, hardcoded tokens) | Guided demonstration |
| Permissions flow | Schema: permissions only after complete validation | Project checklist |
| Support contact | SPOC or channel for technical and security support | Email, Teams, Slack |
✅ Mandatory validation
All third parties with technical access must:
- ✅ Confirm that they have read and understood the materials
- ✅ Take a knowledge validation quiz with a result of ≥ 80%
- ✅ Have a formal record of technical onboarding archived
- ✅ Receive technical permissions only after formal validation
Mandatory record:
| Field | Required? |
|---|---|
| Full name | ✔️ |
| Company / supplier | ✔️ |
| Contact email | ✔️ |
| Completion date | ✔️ |
| Quiz result | ✔️ |
| Internal validator | ✔️ |
🔗 Integration with internal processes
| Process | Application of the model |
|---|---|
| Onboarding checklists | Validation of third parties against the same criteria as Ch. 13 |
| Contracts and clauses | Include a reference to training as a condition of access |
| Access management | Block access until the process has been formally fulfilled |
| Audits and compliance | Use the records as objective evidence of an applied control |
🧩 Links to other documents
| Document | Practical relevance |
|---|---|
04-modelo-inclusao-terceiros.md | Overall strategy for third-party onboarding |
03-checklist-onboarding.md | Traceable checklist applicable to all profiles |
trilho-formativo.md | Cross-reference by role and risk |
14-governanca-contratacao.md | Contractual clauses and formal responsibilities |
📌 The inclusion of third parties requires the same rigour applied to the internal team:
training, validation, traceability, accountability.This model reduces supply chain risks and strengthens the organisation's governance capacity.