# 建立 ICT 供應商盡職調查證據包

這是三個檔案的虛構盡職調查練習：分開供應商聲明與實際證據，找出缺口，再把未決事項交給採購和法務審查。

## 任務

只根據三個來源檔，列出實際存在的證據與所有重要缺口，並說明為什麼採購或法務負責人必須暫緩決定。每個結論都用 [[filename]] 引用。

## 預期推理

供應商提供的是說明與問卷回答，不是獨立或合約證據。刪除證據、資料駐留、子處理者、保證報告與簽署條款都缺少；不能推出認證或可接受風險結論。

## 完整來源資料包

### MicaGrid Systems — fictional supplier profile — supplier-profile.md

```markdown
# MicaGrid Systems — fictional supplier profile

MicaGrid Systems is a fictional hosting supplier for this teaching exercise. Its profile says it can host application workloads in an EU region and describes encryption in transit and at rest.

The profile is a supplier-authored description. It includes no signed contract, independent assurance report, certificate, data-flow diagram, or evidence that the described options are enabled for a particular customer.
```

### MicaGrid Systems — questionnaire response — security-questionnaire.md

```markdown
# MicaGrid Systems — questionnaire response

Status: fictional response, evidence review pending.

The supplier states that customer data can be deleted within 30 calendar days after a written request. It has not attached a deletion test, retention configuration, or service-specific record. Data residency details and the current subprocessor list are unanswered.

These statements are questionnaire answers, not legal or compliance certification.
```

### Procurement review checklist — procurement-review.md

```markdown
# Procurement review checklist

The reviewer has a supplier profile and a questionnaire but no signed data-processing terms, independent assurance report, deletion evidence, residency confirmation, or subprocessor list.

Keep the supplier decision on hold until the responsible procurement and legal owners review the missing evidence and contract terms. Do not infer certification, regulatory approval, or acceptable risk from the supplier's statements. A human owner must record any final decision.
```

## Reference answer: a supplier statement is not a certification

The packet contains supplier descriptions and a questionnaire statement about deletion within 30 days, but no independent or contract evidence. Residency and subprocessors are unanswered, and procurement and legal owners must review the gaps before deciding; no certification or compliance conclusion is warranted.

# MicaGrid Systems — due-diligence reference

## Evidence present

The fictional supplier profile describes EU-region hosting and encryption in transit and at rest, but it is a supplier-authored description with no attached contract, assurance report, certificate, data-flow diagram, or customer-specific enablement evidence. [[supplier-profile.md]]

The questionnaire states that data can be deleted within 30 calendar days after a written request, but provides no deletion test, retention configuration, or service-specific record. Residency and the current subprocessor list are unanswered. [[security-questionnaire.md]]

## Decision boundary

This is an evidence gap, not a legal or compliance certification. The missing terms, assurance report, deletion evidence, residency confirmation, and subprocessor list keep the decision on hold. Procurement and legal owners must review the evidence and contract before recording any final decision. [[procurement-review.md]]

## 變更後來源

### security-questionnaire.md

```markdown
# MicaGrid Systems — questionnaire response, revision 2

Status: fictional response, evidence review pending.

The supplier cannot state a fixed deletion period. Deletion timing depends on the service and written agreement, and no deletion test, retention configuration, or service-specific record is attached. Data residency details and the current subprocessor list remain unanswered.

These statements are questionnaire answers, not legal or compliance certification.
```

## 變更預期

The reference's statement that the supplier says data can be deleted within 30 calendar days becomes stale. Revision 2 removes that fixed period and makes timing dependent on the service and written agreement, so deletion timing is now unknown. The missing evidence, no-certification boundary, hold status, and human procurement/legal review remain unchanged.

## 審查邊界

逐項核對聲明是否有附件證據，特別看刪除紀錄、駐留資料、子處理者與合約；不要把聲明當認證，採購與法務仍需判斷。

## 比較

一份不完整的供應商資料可以手動核對。當問卷修訂、合約、證據附件與人工審查決定需要保持可追溯，又不能虛構保證時，來源連結的盡職調查 wiki 才有幫助。

## 閱讀本地化頁面

https://wenlan.app/zh-TW/learn/build-ict-supplier-due-diligence-evidence-pack