Put a secure supply chain on paper this week — not next financial year.
 
This free download is a single zip with four ready-to-use files:
POL-SC01 Procurement & Secure Supply Chain Policy (Word + PDF)
PROC-SQ01 Supplier Risk Assessment Procedure (Word + PDF)
 
They are written for organizations that cannot treat procurement as a cheapest-quote exercise: Defense-adjacent work, controlled technology, research environments, export-controlled goods, foreign suppliers, and anyone who has to answer for FOCI, sanctions, cyber access, or supply continuity.
 
Why these templates are useful
 
Most supplier policies are either generic purchasing rules or a security add-on bolted on after the contract is signed. These two documents work as one system.
 
The policy gives the board and executive a clear rule set: security, regulatory compliance and integrity of supply take precedence over convenience or short-term cost. It covers governance and delegations, export controls and sanctions, FOCI, cyber baselines (including ASD Essential Eight), sole-source justification, modern slavery and ESG, approved supplier lists, contractual flow-down, incident notification, and close-out.
 
The procedure turns that rule set into a process staff can actually run. It includes a two-tier model (Tier 2 Basic / Tier 1 Enhanced), risk-tiering criteria, step-by-step onboarding, sanctions and restricted-party screening, approval and activation rules, ongoing monitoring, and a seven-year records trail.
Both are written against the Australian operating environment — DTCA and the DSGL, Autonomous Sanctions, FIRB where relevant, PSPF Release 2026 references, and ITAR/EAR where US-origin technology is in play — while remaining customizable for your delegations, roles and systems.
 
Placeholders are marked. Customize before use.
 
Use them to:
Stand up or replace a procurement policy that auditors, primes and government customers will recognise
Stop high-risk suppliers being activated before screening and assessment are complete
Give requesters, finance, legal and security the same playbook
Document sole-source, foreign ownership and export-control decisions instead of relying on email
Flow security, confidentiality and export-control obligations into contracts and subcontractors
The policy and procedure are only half the kit
These four files are free companion documents. To apply them — not just adopt them — they sit alongside the SRMBOK Guide to Risk-Based Supplier Assurance: a full workbook with the tools the policy and procedure point to.
 
That kit includes:
SRQ-T1 Tier 1 Enhanced Supplier Assessment
SRQ-T2 Tier 2 Basic Supplier Assessment
Tier-selection matrix
Completion instructions and assessor guidance
SRQ-A1 Assessor Scoring Worksheet
Fillable PDFs and editable Word templates
 
Together you get governance documents you can issue, plus the questionnaires, scoring method and assessor notes needed to run Basic and Enhanced assessments in practice.
 
Download the zip file. Customize the policy and procedure. Use the Guide and templates to put suppliers through the process.