How do we control an outsourced process so that it counts inside our ISMS scope?

Start

Someone else carries out a process our ISMS scope depends on

The ISMS standard expects a process that someone else carries out for you, and that matters to information security, to be controlled as part of the management system. Outsourcing moves the work and not the responsibility. The auditor asks how you know the process runs as you planned, and that cannot be answered by pointing at a contract alone.

• Then: List the processes in scope that other organisations carry out

Step

List the processes in scope that other organisations carry out

Think of processes and not only products: security monitoring, managed IT, development, payroll, recruitment, a service desk, a data centre or backup service. Start from the services in the scope statement and the asset inventory, and note who carries out each process and which contract covers it.

• Then: Does it touch in-scope information, or run a control you rely on?

Decision

Does it touch in-scope information, or run a control you rely on?

If it does neither, it is an ordinary supplier and the general supplier rules apply. If it does either, or you are not sure, it belongs in the ISMS. A process that handles personal data or runs a control you rely on, such as monitoring or backup, usually does.

• Yes, or not known: Does the contract set your security terms and your right to evidence?
• No: Not part of the ISMS; manage it as an ordinary supplier

Outcome

Not part of the ISMS; manage it as an ordinary supplier

Record why it does not touch information in scope, so the auditor sees the judgement. Review the record when the scope or the process changes. Do not leave it unlisted: an unrecorded outsourced process is the usual finding. Do not call it outside the ISMS if it runs a control you rely on.

Decision

Does the contract set your security terms and your right to evidence?

The contract is where control starts. It should say what security the provider must keep, how it tells you of incidents, whether it may subcontract, and what evidence you may see. A provider's standard terms rarely do all of that. Not known takes the no branch.

• Yes: Define the interface: who does what, and who owns it for you
• No, or not known: Add the missing requirements at renewal or by addendum

Step

Add the missing requirements at renewal or by addendum

Use the clause library for security requirements, incident notice, audit or evidence rights, subcontracting and exit. If the provider runs your IT, also settle whose policies apply. Where the provider refuses a term, record an exception with an owner and an expiry.

• Then: Define the interface: who does what, and who owns it for you

Step

Define the interface: who does what, and who owns it for you

Write down what the provider does, what you do, where the work changes hands and which person in your organisation owns the relationship. Add it to the scope statement as an interface. The owner is the person the auditor will interview.

• Then: Does the provider hand any of the process to a subcontractor?

Decision

Does the provider hand any of the process to a subcontractor?

Much of the risk in outsourcing sits one step further down. You need to know who does the work and to hear of changes. Not known takes the yes branch until the provider has said.

• Yes, or not known: Ask who, require notice of changes and pass your requirements down
• No: Do you receive regular evidence that someone reviews?

Step

Ask who, require notice of changes and pass your requirements down

Get the names and locations of the subcontractors that matter, make notice of significant changes a contract term, and require the provider to hold its subcontractors to the same requirements. The pack's guidance for supply chain security is to look beyond the first-tier supplier.

• Then: Do you receive regular evidence that someone reviews?

Decision

Do you receive regular evidence that someone reviews?

Evidence can be service reports, incident notices, test results, access reviews of the provider's staff, or a certificate with a scope that covers the process. A reviewer in your organisation must read it and act on it. A folder of reports nobody opens does not count.

• Yes: Does the provider carry out a whole Annex A control for you?
• No, or not known: Agree the evidence, its timing and the reviewer

Step

Agree the evidence, its timing and the reviewer

Choose evidence that shows the process runs as planned, such as service reports, incident logs and test results, and add a certificate or assurance report if its scope covers the service. Name who reviews it and when. Put the dates in the supplier calendar.

• Then: Does the provider carry out a whole Annex A control for you?

Decision

Does the provider carry out a whole Annex A control for you?

Some controls are run entirely by the provider, such as the physical protection of a data centre. Others are shared, where you configure and the provider operates. The Statement of Applicability should show which it is.

• Yes: Keep it applicable, mark it delivered by the supplier, cite evidence
• No, only part of it: Mark it as shared and name your own duties

Step

Keep it applicable, mark it delivered by the supplier, cite evidence

Do not exclude a control because a supplier performs it. Mark it applicable, say it is delivered by the supplier, and name the report or certificate that supports it. The wording guide shows the wording that withstands challenge.

• Then: Audit the interface and review the provider's evidence

Step

Mark it as shared and name your own duties

Say what the provider does and what you do, such as configuring access or reviewing its logs. Keep your own evidence for your side. The provider's evidence covers only its side.

• Then: Audit the interface and review the provider's evidence

Step

Audit the interface and review the provider's evidence

Sample the provider's output and your oversight of it: the last reports and who read them, how a recent incident or change was handled, and whether the contract terms were followed. Treat a major change or incident at the provider as a reason to reassess.

• Then: Did the audit or evidence show the process is not running as planned?

Decision

Did the audit or evidence show the process is not running as planned?

A late report, an expired certificate, an unreviewed incident notice or a changed subcontractor are all findings. The question is whether your control worked, not whether the provider is at fault.

• Yes: Raise it as a finding, agree a fix with the provider and check again
• No: Outsourced process defined, evidenced, audited and inside the scope

Step

Raise it as a finding, agree a fix with the provider and check again

Record the finding, find the cause, agree an action and date with the provider, and check the result. If the provider keeps failing, consider the supplier exit route and a recorded exception for the time it takes.

• Then: Audit the interface and review the provider's evidence (back to an earlier step)

Outcome

Outsourced process defined, evidenced, audited and inside the scope

Keep the interface description, the contract terms, the evidence and its review, and the audit sample. Do not say the provider's certificate covers you, and do not claim you control a process you cannot see.