供应商信息安全风险评估检查表

All areas covered by the **** project must be
2
identified, including but not limited to sensitive raw
materials and equipment areas, storage areas and
warehouse areas, access and transportation routes,
s供ec应ur商ity须po建lic立ie人s, 员reg离ul职ati处on理s a流nd程ot，he至rs,少an要d 关the闭信
息系统帐号和权限，回收存储介质（包含电脑）
。
2.5
The suppliers must establish a process for employee
1
termination, at least to disable the information
access, such as implement data encryption or data
总得分
leakage prevention.
Subtotal 得分率
Percentage %
1
1 4
50.00%
4、物理与环境安全 4. Physical and environment security
总得分
system accounts and permissions, and return the
Subtotal 得分率
Percentage %
9 90.00%
3、数据和介质管理 3. Data and media management
序号# S/N 3.1
3.2
信息安全要求 Information Security Requirements 供应商须对****数据进行分级和分类，包含图纸
2
information security policies and check the
总得分
implementation of relevant control measures.
Subtotal
13
得分率
Percentage %
92.86%
2、人员管理
序号# S/N
信息安全要求 Information Security Requirements
自评得分 Selfassessment
、技术规格书及合同内容的数据应定义为涉密信
息（后面统称****涉密信息）。
The suppliers must categorize and classify **** data. The data including drawings, technical
1
specifications and contract should be defined as
自评得分 负责部门
Self-
Responsible
供应商招聘人员时应进行背景调查，特别是关键 assessment Department
岗位人员。
2.1
Background checks on all candidates for
2
e供m应plo商ym须e与nt所sh有ou员ld 工be签ca署rriNedDoAu，t, e特sp别ec是ial参ly与fo*r*k*e*y 项目及能接触****信息和系统的员工。
management, documents management and risk
assessment.
负责部门 Responsible Department
供应商应定期审查信息安全策略并对相关控制措
施的执行情况进行检查。
1.7
The suppliers should periodically review the
****项目和在****现场调试的人员。
The suppliers must pass on the requirements of <
2
Information Security Instruction of Supplier Visit
with the ****> (The latest file is called "****
1
responsibilities, and make them available to to all
e供m应plo商ye应es制. 定信息安全的相关策略（应充分考虑 客户的信息安全要求），组织各级员工了解并可 获取。
The suppliers should establish the information
1.5 1.6
信息安全要求
自评得分
Information Security Requirements 供应商须建立信息安全管理组织并定义其职责，
Selfassessment
组织各级员工可获取。
The suppliers must establish an information security
management organization and define their
供应商须建立移动存储介质的管理规定，含有
****涉密信息的介质未经授权禁止带离公司。
3.3
The suppliers must establish management regulations for mobile storage media. It is forbidden
that the media including **** confidential
供应商信息安全风险评估检查表 Information Security Risk Assessment Checklist for Suppl
1、信息安全组织及策略 1. Information security organization and policy
序号# S/N 1.1 1.2
1.3
1.4
少保存1年。
The entrance control must be implemented at the entrance and exit of the **** security zone.
Supplier Security and Confidential Instructions") to
relevant employees, especially those were involved 供应商若提供设备电脑给****，设备进入****前 须按照****《设备电脑信息安全管理工作指示》 进行自查，并将要求传达给相关人员（特别是在 ****的现场工程师）。
If the suppliers provides the equipment computer to ****, the equipment must be self-inspected
2
according to the **** "Equipment Computer
Information Security Management Work
2
must use the '**** rental laptop' to debug, and this
requirement is made available to the relevant p供er应so商nn须el.实施项目信息安全管理，尤其是****项 目，包含密级划分、人员管理、文档管理、风险 评估等。
2
for the areas involved in the **** project, and the
security level is clearly identified with a label. The
s*e*n*s*i安tiv全e r区aw域m出at入eri口als处an须d 设eq置uip门m禁en刷t a卡rea机s a，nd授权 人员通过门禁卡进出安全区域，门禁进出记录至
序号# S/N 4.1
4Байду номын сангаас2
4.3 4.4 4.5
信息安全要求
自评得分
Self-
Information Security Requirements
assessment
必须识别****项目涉及的全部区域，包括但不限
于敏感原材料和设备区、存放区和仓库区、通道
和运输路线、研发区、生产区、测试区、办公室
以及装货/发货区。
2
securty policies (Customer's information security
requirements should be fully considered) and make
t供he应m商av须ail将ab*le**to*的all《em供p应loy商ee来s.访我司安全保密须 知》（最新版文件名为《**** 供应商安全保密须 知 》的要求传达至内部相关人员，特别是参与
Instruction" before entering the ****, and the
r供eq应ui商rem若e参nts与ar*e*a*v*a现ila场bl的e t设o t备he调re试lev，an须t p使er用so*n*n*e*l 租赁笔记本电脑进行调试，并将要求传达给相关
人员。
If the suppliers debug the equipment at ****, they
i供nf应orm商a应tio对n i*s*t*a*k的en涉aw密ay信fr息om采t取he防co护m措pan施y，wi确tho保ut 其未被非授权访问或获取，如数据加密、数据防
泄漏等。
3.4
The suppliers should take actions for ****