What evidence do auditors commonly ask for on 5.22 Monitoring, review and change management of supplier services?

Service performance reports and minutes of periodic supplier review meetings; Records of supplier changes (new technology, locations, releases, sub-suppliers) with the organization's assessment of each; Supplier audit reports and reviews of independent auditor or attestation reports, with tracked follow-up of findings; Incident and security event information received from suppliers and the organization's review of it; Evidence of supplier continuity capability such as tested continuity plans or exercise results; A named relationship owner for each critical supplier and records of actions taken on service deficiencies.

What is the most common gap auditors find on 5.22?

Supplier changes such as moving hosting location or adding sub-processors happen without notice or review

ISO/IEC 27002:2022 · Organizational controls

`5.22` Monitoring, review and change management of supplier services

On a regular basis the organization is to monitor, review and evaluate suppliers' security practices and service delivery and to manage changes to them. Purpose: keep information security and service delivery at the level set in the supplier agreements. Guidance: this oversight should confirm that the security terms are honoured, that incidents and problems are handled properly and that changes in the supplier's services or business situation do not disrupt delivery. A relationship management process should: check service performance against the agreement; track supplier-side changes such as service enhancements, new applications and systems, revised policies and procedures, and new or changed controls to fix incidents or improve security; track changes in the services themselves such as network changes, new technologies, new products, versions or releases, new development tools and environments, relocated facilities, and changed or added sub-suppliers or subcontracting; review supplier service reports and hold the progress meetings the agreement calls for; audit suppliers and sub-suppliers, alongside independent auditor reports where available, and follow up findings; exchange and review incident information as agreed; examine supplier audit trails and records of security events, operational problems, failures, fault tracing and disruptions; respond to and manage identified events or incidents; identify and manage vulnerabilities; review the security of the supplier's own supplier relationships; make sure the supplier keeps enough capacity and workable plans to hold agreed continuity levels after major failure or disaster (see 5.29 and 5.30, 5.35 and 5.36, and 8.14); make sure suppliers name people responsible for checking and enforcing compliance with the agreement; and regularly evaluate whether the supplier keeps adequate security. A designated person or team owns each relationship, with the technical skills and resources to check that requirements, especially security ones, are met, and deficiencies trigger appropriate action. ISO/IEC 27036-3 gives more detail.

Source: ISO/IEC 27002:2022, 5.22. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

hard

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Service performance reports and minutes of periodic supplier review meetings · SIEM / log platform
Records of supplier changes (new technology, locations, releases, sub-suppliers) with the organization's assessment of each · SIEM / log platform
Supplier audit reports and reviews of independent auditor or attestation reports, with tracked follow-up of findings · SIEM / log platform
Evidence of supplier continuity capability such as tested continuity plans or exercise results · SIEM / log platform
A named relationship owner for each critical supplier and records of actions taken on service deficiencies · SIEM / log platform

governing documentDocuments that govern the control

Incident and security event information received from suppliers and the organization's review of it · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Supplier changes such as moving hosting location or adding sub-processors happen without notice or review
Assurance reports are filed but exceptions in them are never followed up
No one is accountable for monitoring security performance of a given supplier
Supplier incident information is not integrated into the organization's incident process

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.21 Managing information security in the ICT supply chain · 5.23 Information security for use of cloud services