A.5.22 Monitoring, review and change management of supplier services
Regularly monitor, review and manage change in supplier security practice and service delivery.
12
artefacts
1
held by a system
7
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Incident log of supplier‑reported security events · SIEM / log platform
periodic reviewEvidence produced at each review
- Monthly security performance dashboard · SIEM / log platform
- Risk assessment updates for supplier services · SIEM / log platform
- Minutes of quarterly service review meetings · Vendor register / contract repository
- Action item tracker from review meetings · Vendor register / contract repository
- Attendance register for review sessions · HR system / LMS
- Signed service level agreement with security clauses · Vendor register / contract repository
- Periodic compliance audit reports · Vendor register / contract repository
governing documentDocuments that govern the control
- Change request forms submitted by supplier · Policy repository / GRC workspace
- Approved change implementation plans · Policy repository / GRC workspace
- Post‑implementation verification reports · Policy repository / GRC workspace
- Records of contract amendment approvals · Vendor register / contract repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- relying on informal verbal updates
- missing documented approval for supplier changes
- infrequent or ad‑hoc monitoring
- no evidence linking monitoring to risk treatment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.5.21 Managing information security in the ICT supply chain · A.5.23 Information security for use of cloud services