5.19 Information security in supplier relationships
The organization is to define and run processes and procedures that manage the information security risks arising from using suppliers' products or services. Purpose: keep security in dealings with suppliers at the level both sides agreed. Guidance: set a topic-specific supplier relationship policy and share it with relevant parties. Processes, including those applying to cloud service providers and those the organization requires suppliers to follow when use of a product or service starts or ends, should cover: identifying and recording the kinds of supplier (ICT services, logistics, utilities, financial services, infrastructure components) that could affect confidentiality, integrity or availability; deciding how suppliers are evaluated and chosen according to sensitivity, using market analysis, references, document review, on-site assessment or certification; choosing and reviewing products and services with adequate controls, especially the accuracy and completeness of controls protecting that the supplier's own information and processing stay intact; defining which information, ICT services and physical infrastructure suppliers may access, monitor, control or use; defining the supplier-provided infrastructure components and services that could affect the organization; assessing and managing risks from suppliers' use of the organization's assets (including malicious supplier staff) and from faulty or vulnerable products, components or services; monitoring compliance per supplier and access type, which can involve independent reviews and validating products; dealing with supplier non-compliance however it is found; handling supplier-related incidents and contingencies with each side's responsibilities; resilience, recovery and contingency so the supplier's information and processing stay available; awareness and training for staff who deal with supplier personnel; managing transfers of information and assets securely during transition; secure termination covering removal of access, information handling, ownership of intellectual property created, portability on change of supplier or insourcing, records management, returning assets, disposing of them securely and keeping confidentiality going afterwards; and the personnel and physical security expected of supplier staff and sites. Plans for continuing if a supplier can no longer deliver, for example by pre-identifying or routinely using alternatives, should be considered. Other information: where requirements cannot be imposed, use this guidance in choosing the supplier and add compensating controls based on risk; NDAs or cryptography can protect confidentiality, cross-border data access raises privacy risk, legal responsibility for the information stays with the organization, and vulnerable supplier components can harm the organization or others; ISO/IEC 27036-2 has more detail.
Source: ISO/IEC 27002:2022, 5.19. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Supplier monitoring and non-compliance records with remediation actions · SIEM / log platform
periodic reviewEvidence produced at each review
- Supplier due diligence and selection records such as questionnaires, certifications, references and on-site assessment reports, scaled to sensitivity · Vendor register / contract repository
- Supplier risk assessments covering misuse of organizational assets and product or component vulnerabilities · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- The topic-specific supplier relationship policy and its communication record · Vendor register / contract repository
- A supplier inventory categorized by type and by the information, services and infrastructure each can access · Vendor register / contract repository
- Exit and contingency plans for critical suppliers covering access removal, data return or destruction, portability, intellectual property and alternative supply · Vendor register / contract repository
First move
Common gaps auditors find
- Suppliers are onboarded by procurement without any security assessment
- Cloud service providers are not treated as suppliers under the policy
- No exit plan exists for critical suppliers, so access and data linger after termination
- Monitoring stops after onboarding and relies solely on an annual certificate
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.18 Access rights · 5.20 Addressing information security within supplier agreements