Procurement
Overview
Procurement is another domain of the organisation. The Manual does not say how Procurement negotiates; it says what must exist before a supplier comes in: security validation, clauses in the contract, periodic reassessment.
Key Responsibilities
- Execute the formal supplier validation flow (questionnaire → AppSec analysis → approval)
- Ensure, with Legal, that contracts include the security clauses
- Coordinate the periodic reassessment of suppliers and the escalation of critical incidents
- Take part in contracting AI model providers, with GRC / Compliance
Specialisation: Procurement Officer, who executes the validation flow.
Organisational Context
Third-party risk management is an express obligation in DORA (ICT third-party risk) and NIS2 (supply chain security). The decision and the record stay with GRC / Compliance; executing the purchasing flow belongs to Procurement.
Regulatory Framework
Supports:
- DORA: ICT third-party risk management
- NIS2: Supply chain security
- CRA: Due diligence on third-party components
Activities by Chapter
Ch. 14 - Governance and Contracting
Execute supplier validation before onboarding, include SbD-ToE clauses in contracts and reassess suppliers at the cadence of the risk level.
User Stories:
- US-02: Contractual security clauses - Supplier compliance (with Legal)
- US-06: Execution of the formal supplier validation flow - Minimum requirements before onboarding
- US-14: Continuous supplier reassessment - Periodic re-approval (with AppSec Engineer)
- US-21: Contracting AI model providers - Minimum clauses for AI providers (with GRC / Compliance and Legal)
Chapter References
For full context and framing: