A.5.19 Information security in supplier relationships
Define and apply processes to manage the security risk suppliers introduce.
12
artefacts
4
held by a system
4
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Service level agreement with security metrics · Vendor register / contract repository
- Vulnerability scan results for supplier services · Vulnerability scanner / patch tooling
- Security performance dashboard · SIEM / log platform
- Incident logs of supplier security breaches · SIEM / log platform
periodic reviewEvidence produced at each review
- Supplier risk assessment report · Vendor register / contract repository
- Signed contracts containing security clauses · Vendor register / contract repository
- Periodic third‑party audit reports · SIEM / log platform
- Breach notification communication records · Vendor register / contract repository
governing documentDocuments that govern the control
- Supplier risk register · Vendor register / contract repository
- Completed due diligence questionnaire · Vendor register / contract repository
- Data protection addendum · Document repository
- Joint incident response plan with supplier · Vendor register / contract repository
First move
Start with the 4 of 12 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Treating all suppliers as low risk
- Missing security clauses in contracts
- Insufficient ongoing monitoring of supplier security
- No documented breach notification process
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.5.18 Access rights · A.5.20 Addressing information security within supplier agreements