9 docs tagged with "contratação"

Binary control checklist of the application of governance practices per project

Structures, policies and practices to ensure organisational governance, supplier integration and transparency in the SbD-ToE cycle

Canonical catalogue of organisational security governance requirements (GOV-001 to GOV-017), with applicability by risk level and acceptance criteria for ownership, exceptions, contracting, traceability, continuous validation, maturity, technical onboarding of third parties, access review, coordinated vulnerability disclosure, privileged accounts and identity lifecycle.

Practical integration of governance, exception and contracting practices into the SbD-ToE lifecycle

Formal policies that sustain the governance, exception and supplier management practices described in this chapter

What SbD-ToE requires to exist on the Procurement side

Organisational policy that defines the security requirements applicable to the contractual lifecycle with suppliers and contractors, including pre-contractual due diligence, minimum contractual clauses by risk level, technical onboarding, compliance monitoring, periodic reassessment and secure offboarding, proportional to the criticality level (L1, L2, L3).

Security contractual clauses in contracts with suppliers, contractors and technical third parties

Process for security validation of suppliers, contractors and technical third parties