Contractor Validation Template
Version: 1.0
Last update: November 2025
Responsible: HR + AppSec Engineer
Review frequency: Annual (validate against the most recent security policies)
📖 Use of this Template
This document serves as a structured validation checklist for new contractors before formal contracting or access to systems. It is used in US-06 (initial supplier validation) and US-15 (pre-access technical preparation).
Responsibilities:
- Procurement Officer: Coordination of the flow, filling in parts 1–3
- AppSec Engineer: Filling in parts 4–5, security validation
- Tech Lead: Validate technical requirements and preparation (part 6)
- HR: Verification of references and legal documentation (part 2)
Estimated time: 2–3 weeks before the start date
✅ PART 1: Basic Information
| Field | Entry | Observations |
|---|---|---|
| Contractor's full name | [_______________] | |
| Corporate email | [_______________] | Will be created after approval |
| Contact mobile phone | [_______________] | |
| Nationality | [_______________] | Relevant for data residency (GDPR, etc.) |
| Planned start date | [_______________] | |
| Contract duration | [_______________] | E.g.: 3 months, 6 months, indefinite |
| Supplier/Agency | [_______________] | If applicable |
| Role/Function | [_______________] | E.g.: Backend Developer, DevOps Engineer, QA |
| Team/Project | [_______________] | |
| Responsible Tech Lead | [_______________] | Technical validator |
| Security Champion | [_______________] | Security validator |
| Criticality classification | [ ] L1 [ ] L2 [ ] L3 | Defined by Tech Lead + AppSec |
✅ PART 2: Background Verification and Legal Documentation
2.1 Verification of References
| Item | Yes | No | N/A | Observations |
|---|---|---|---|---|
| Contact with a previous reference (Tech Lead/Manager) | [ ] | [ ] | [ ] | Date: []. Feedback: [____________] |
| Background check verification (police/criminal) | [ ] | [ ] | [ ] | Status: [_____________] |
| Verification of professional credentials | [ ] | [ ] | [ ] | Certifications validated? [_________________] |
2.2 Legal Documentation
| Item | Submitted | Validated | Observations |
|---|---|---|---|
| Signed contract | [ ] | [ ] | Date: [_____] |
| NDA (Non-Disclosure Agreement) | [ ] | [ ] | Digitally signed? [ ] Yes |
| Confidentiality Agreement | [ ] | [ ] | Post-termination duration: [___________] |
| IP Assignment (if applicable) | [ ] | [ ] | Developed code belongs to: [__________] |
| Non-Compete (if applicable) | [ ] | [ ] | Duration: [_], scope: [________] |
| Data Protection/GDPR compliance | [ ] | [ ] | Has the contractor confirmed acceptance of data processing? |
✅ PART 3: Initial Technical Assessment
3.1 Technical Skills and Background
| Question | Answer | Validated by | Observations |
|---|---|---|---|
| Security experience | [_______________] | Tech Lead | E.g.: "2 years in secure coding" |
| Experience with security tools? | [ ] Yes [ ] No | AppSec | Which: [__________________] |
| Previous experience in regulated environments (DORA, ISO, PCI)? | [ ] Yes [ ] No | AppSec | Details: [__________________] |
| Relevant certifications | [_______________] | HR | E.g.: OSCP, CEH, CSSLP, CKAD |
| Programming languages | [_______________] | Tech Lead | Relevant to the project |
| CI/CD and Infra experience | [ ] Yes [ ] No | DevOps | Tools: [__________________] |
| Knowledge of containers/Kubernetes | [ ] Yes [ ] No | DevOps | Level: [ ] Basic [ ] Intermediate [ ] Advanced |
3.2 Initial Security Screening
| Question | Answer | Assessment |
|---|---|---|
| Does the contractor agree to accept the company's security policy? | [ ] Yes [ ] No | Status: [ ] ✅ Approved [ ] ❌ Rejected |
| Has the contractor confirmed that there is no conflict of interest? | [ ] Yes [ ] No | Status: [ ] ✅ Approved [ ] ❌ Rejected |
| Does the contractor agree to use secure corporate equipment? | [ ] Yes [ ] No | Status: [ ] ✅ Approved [ ] ❌ Rejected |
| Has the contractor confirmed that they are not on an international sanctions list? | [ ] Yes [ ] No | Status: [ ] ✅ Approved [ ] ❌ Rejected |
Screening Result: [ ] ✅ Approved [ ] ❌ Rejected
Justification (if rejected): [_____________________]
✅ PART 4: Security Validation (AppSec Engineer)
4.1 Security Awareness Questions (Minimum Level)
Instructions: Send this form to the contractor. Minimum required score: 70%
| # | Question | Expected Answer | Did the Contractor Answer? | Score |
|---|---|---|---|---|
| 1 | What is the first step if you suspect phishing? | Do not reply, report to security | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 2 | Can you share corporate credentials with colleagues? | No, each person has personal access | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 3 | What is the procedure if you forget your password? | Contact IT/Secure password reset | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 4 | Can you connect a personal VPN or an external proxy? | No, only the corporate VPN | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 5 | What is the process for reporting a security incident? | Contact [CISO/Security email] immediately | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 6 | Can you bring unauthorised personal devices? | No, only approved equipment | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 7 | Is MFA mandatory for corporate login? | Yes, always activate MFA | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 8 | What is the session duration before automatic timeout? | [Internal policy, e.g.: 30 min] | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 9 | Can you leave your workstation unlocked and unattended? | No, lock or logout mandatory | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
| 10 | What is the post-termination confidentiality policy? | Confidential data remains confidential | [ ] Yes [ ] No | [ ] ✅ [ ] ❌ |
Total Score: /10 (%)
Minimum required: 70% (7/10)
Result: [ ] ✅ PASSED [ ] ❌ FAILED (Retry: [ ] Scheduled for [____])
4.2 Equipment Validation
| Item | Status | Observations |
|---|---|---|
| Is the computer personal or corporate? | [ ] Personal [ ] Corporate | If personal, requires special approval |
| Operating system and version | [_______________] | Must be up to date (last 6 months of patches) |
| Antivirus/Antimalware installed? | [ ] Yes [ ] No | Tool: [__________________] |
| Firewall activated? | [ ] Yes [ ] No | |
| Encrypted disk (LUKS/BitLocker)? | [ ] Yes [ ] No | Mandatory for L2–L3 |
| Last malware verification | [_______________] | Date and result |
| Confirmation: Contractor undertakes to keep equipment secure | [ ] Yes [ ] No |
Result: [ ] ✅ Approved [ ] ⚠️ Conditional (with plan) [ ] ❌ Rejected
4.3 Risk Assessment (AppSec Engineer)
| Dimension | L1 | L2 | L3 | Observations |
|---|---|---|---|---|
| Risk of access to sensitive data | [ ] | [ ] | [ ] | [_________________] |
| Risk of modification of critical code | [ ] | [ ] | [ ] | [_________________] |
| Risk of privilege escalation | [ ] | [ ] | [ ] | [_________________] |
| Risk of leakage of IP/confidential information | [ ] | [ ] | [ ] | [_________________] |
Overall Risk: [ ] Low [ ] Medium [ ] High [ ] Very High
Approval: [ ] ✅ Recommended [ ] ⚠️ Conditional [ ] ❌ Not recommended
Justification: [_____________________________________]
✅ PART 5: Decision Report
5.1 Validation Summary
| Criterion | Result | Responsible |
|---|---|---|
| Legal Documentation | [ ] ✅ Complete [ ] ⚠️ Pending [ ] ❌ Missing | [__________] |
| Background Check | [ ] ✅ Passed [ ] ⚠️ Review [ ] ❌ Failed | [__________] |
| Technical/Skills | [ ] ✅ Approved [ ] ⚠️ Conditional [ ] ❌ Rejected | [__________] |
| Security Awareness | [ ] ✅ Passed (>70%) [ ] ⚠️ Retry [ ] ❌ Failed | [__________] |
| Risk Assessment | [ ] ✅ Approved [ ] ⚠️ Conditional [ ] ❌ Not recommended | [__________] |
5.2 Final Decision
Overall Decision:
[ ] ✅ APPROVED → Proceed to Technical Preparation (US-15)
[ ] ⚠️ APPROVED WITH CONDITIONS → Specify the mitigation plan below
[ ] ❌ REJECTED → Contact Procurement with a justification
Mitigation Plan (if conditional):
1. [_____________________________] → Prazo: [_____] → Owner: [_______] → Status: [ ]
2. [_____________________________] → Prazo: [_____] → Owner: [_______] → Status: [ ]
3. [_____________________________] → Prazo: [_____] → Owner: [_______] → Status: [ ]
5.3 Formal Approvals
| Role | Name | Digital Signature | Date | Observations |
|---|---|---|---|---|
| HR Manager | [__________] | [Signed] | [____] | |
| Tech Lead | [__________] | [Signed] | [____] | |
| AppSec Engineer | [__________] | [Signed] | [____] | |
| Procurement Officer | [__________] | [Signed] | [____] | If L2–L3 |
✅ PART 6: Next Steps (Post-Approval)
If APPROVED, the following actions are triggered automatically:
6.1 Preparation Timeline
| Date | Action | Owner | Status |
|---|---|---|---|
| T-14 days | Sandbox setup + LMS enrolment | DevOps + Training | [ ] Done |
| T-10 days | Welcome email + onboarding info | HR | [ ] Done |
| T-7 days | Online training started | Training Manager | [ ] Done |
| T-3 days | Comprehension quiz (score >80%) | Contractor + AppSec | [ ] Done |
| T-1 day | Confirmation of completion | Security Champion | [ ] Done |
| T-0 (Day 1) | Access granted + technical onboarding | DevOps | [ ] Done |
6.2 Subsequent Checklists
After approval in this template, the contractor follows:
- US-15: Technical Preparation (Sandbox, NDA, training)
- US-16: Mandatory Training Track (Ch. 13)
- Actual Access: After completion of US-15 and US-16
📎 Annexes and References
- Ch. 13 - Training and Onboarding
- US-06: Supplier Validation Flow
- US-15: Technical Preparation of Contractors
- US-16: Training Track
- Governance Model
🏁 Final Notes
- This template is mandatory for L2–L3 and recommended for L1.
- Keep the history of all validations for the duration of the contract + 1 year (+ 3 years at L3), in line with Policy 33.
- Review this template annually against updated security policies.
- Escalation: If any field raises a red flag, contact the CISO before approval.