# 建立 ICT 供应商尽职调查证据包

这是三个文件的虚构尽职调查练习：分开供应商声明与实际证据，找出缺口，再把未决事项交给采购和法务审核。

## 任务

只根据三个来源文件，列出实际存在的证据和所有重要缺口，并说明为什么采购或法务负责人必须暂缓决定。每个结论都用 [[filename]] 引用。

## 预期推理

供应商提供的是说明和问卷回答，不是独立或合同证据。删除证据、数据驻留、子处理者、保证报告和签署条款都缺失；不能推出认证或可接受风险结论。

## 完整来源资料包

### MicaGrid Systems — fictional supplier profile — supplier-profile.md

```markdown
# MicaGrid Systems — fictional supplier profile

MicaGrid Systems is a fictional hosting supplier for this teaching exercise. Its profile says it can host application workloads in an EU region and describes encryption in transit and at rest.

The profile is a supplier-authored description. It includes no signed contract, independent assurance report, certificate, data-flow diagram, or evidence that the described options are enabled for a particular customer.
```

### MicaGrid Systems — questionnaire response — security-questionnaire.md

```markdown
# MicaGrid Systems — questionnaire response

Status: fictional response, evidence review pending.

The supplier states that customer data can be deleted within 30 calendar days after a written request. It has not attached a deletion test, retention configuration, or service-specific record. Data residency details and the current subprocessor list are unanswered.

These statements are questionnaire answers, not legal or compliance certification.
```

### Procurement review checklist — procurement-review.md

```markdown
# Procurement review checklist

The reviewer has a supplier profile and a questionnaire but no signed data-processing terms, independent assurance report, deletion evidence, residency confirmation, or subprocessor list.

Keep the supplier decision on hold until the responsible procurement and legal owners review the missing evidence and contract terms. Do not infer certification, regulatory approval, or acceptable risk from the supplier's statements. A human owner must record any final decision.
```

## Reference answer: a supplier statement is not a certification

The packet contains supplier descriptions and a questionnaire statement about deletion within 30 days, but no independent or contract evidence. Residency and subprocessors are unanswered, and procurement and legal owners must review the gaps before deciding; no certification or compliance conclusion is warranted.

# MicaGrid Systems — due-diligence reference

## Evidence present

The fictional supplier profile describes EU-region hosting and encryption in transit and at rest, but it is a supplier-authored description with no attached contract, assurance report, certificate, data-flow diagram, or customer-specific enablement evidence. [[supplier-profile.md]]

The questionnaire states that data can be deleted within 30 calendar days after a written request, but provides no deletion test, retention configuration, or service-specific record. Residency and the current subprocessor list are unanswered. [[security-questionnaire.md]]

## Decision boundary

This is an evidence gap, not a legal or compliance certification. The missing terms, assurance report, deletion evidence, residency confirmation, and subprocessor list keep the decision on hold. Procurement and legal owners must review the evidence and contract before recording any final decision. [[procurement-review.md]]

## 变更后来源

### security-questionnaire.md

```markdown
# MicaGrid Systems — questionnaire response, revision 2

Status: fictional response, evidence review pending.

The supplier cannot state a fixed deletion period. Deletion timing depends on the service and written agreement, and no deletion test, retention configuration, or service-specific record is attached. Data residency details and the current subprocessor list remain unanswered.

These statements are questionnaire answers, not legal or compliance certification.
```

## 变更预期

The reference's statement that the supplier says data can be deleted within 30 calendar days becomes stale. Revision 2 removes that fixed period and makes timing dependent on the service and written agreement, so deletion timing is now unknown. The missing evidence, no-certification boundary, hold status, and human procurement/legal review remain unchanged.

## 审核边界

逐项核对声明是否有附件证据，特别看删除记录、驻留数据、子处理者与合同；不要把声明当认证，采购与法务仍需判断。

## 对比

一份不完整的供应商资料可以手动核对。当问卷修订、合同、证据附件和人工审核决定需要保持可追溯，又不能虚构保证时，来源链接的尽职调查 wiki 才有帮助。

## 阅读本地化页面

https://wenlan.app/zh-CN/learn/build-ict-supplier-due-diligence-evidence-pack