5.19 Information security in supplier relationships
Requires processes and procedures to be defined and implemented for managing the information security risks that arise from using suppliers' products or services.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The supplier security process, covering identification, risk assessment, selection, onboarding and exit · HR system / LMS
- Risk assessments performed for suppliers in the period, at the depth their tier requires · Vendor register / contract repository
- Evidence of assurance obtained, such as certification, an assurance report or an assessment questionnaire with follow up on gaps · Vendor register / contract repository
- Records of exit or termination handling, covering return or deletion of information and revocation of access · HR system / LMS
governing documentDocuments that govern the control
- The supplier register with risk tiering, showing what drives the tier such as data access, criticality or connectivity · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Register limited to suppliers procurement knows about, missing services engaged directly by business teams
- Risk tiering assigned by contract value rather than by information access or operational criticality
- Certificates collected at onboarding and never reread, including certificates whose scope excludes the service actually bought
- Exit never exercised, so information and access persist after the relationship ends
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.18 Access rights · 5.20 Addressing information security within supplier agreements