5.22 Monitoring, review and change management of supplier services
Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regular basis, and requires change within them to be managed.
5
artefacts
0
held by a system
5
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The schedule of supplier reviews, showing frequency by tier and evidence the schedule was met · Vendor register / contract repository
- Service reports and security metrics received from suppliers, and the review of them · Vendor register / contract repository
- Records of issues raised with suppliers, and their resolution or escalation · Vendor register / contract repository
- Evidence of how supplier change is managed, including notification of change, assessment of its security impact and approval where required · Vendor register / contract repository
- Reassessment records where a supplier changed subcontractor, location or service model · Vendor register / contract repository
governing documentDocuments that govern the control
none for this control
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Reviews cover commercial performance and service levels with security never on the agenda
- Supplier self reported metrics accepted with no independent verification of anything
- Supplier changes discovered after the fact because there is no notification obligation or nobody monitors it
- Reviews scheduled annually and quietly skipped, with no record of the omission
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.21 Managing information security in the ICT supply chain · 5.23 Information security for use of cloud services