Control A.5.19Information security in supplier relationships
What it means in practice
Processes and procedures must be defined and implemented to manage the information security risks associated with the use of supplier products or services.
The parent of the supplier family — agreements in A.5.20, the ICT supply chain in A.5.21, monitoring in A.5.22, cloud in A.5.23 — and what it asks for is that supplier risk is managed as a process rather than handled contract by contract.
That means knowing which suppliers exist and what they have access to, assessing them proportionately to that access, and deciding what happens when an assessment finds something. A questionnaire returned and filed is not a process; a questionnaire that can produce a “no” is.
The hardest part in practice is discovery. Suppliers arrive through procurement, through expense claims, through a developer’s credit card, and an organisation that assesses only the suppliers procurement knows about is assessing the ones least likely to be the problem. Shadow arrangements are where the real third-party exposure usually sits.
How to put this in place
Every supplier that touches your information or services brings risk into your ISMS. Without a tiered view, effort goes to the wrong suppliers and the dangerous ones go unchecked.
- List your suppliers and note what information or service each one touches.
- Tier them by the risk they bring.
- Set the security requirements each tier must meet and write them into a supplier security policy.
- Assess higher tiers before contracting; A.5.22 covers reassessment on a cycle.
- Check that any certificate covers the service you actually buy; see also A.5.20 and A.5.21.
Evidence an auditor usually looks for: the tiered supplier register, completed assessments for a sample of higher-tier suppliers, and the supplier security policy.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists rules for managing information security risk from suppliers among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Third-Party Security Policy
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole policy: supplier risk managed from selection to exit (TP-01 to TP-11). - Word
Supplier Security Assessment Procedure
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole procedure: supplier risk assessed and decided before and during the relationship. - Word
Supplier Criticality & Tiering Model
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole model: supplier risk addressed in proportion to what the supplier does for us. - Excel
Tiered Supplier Security Questionnaire
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole workbook: supplier security requirements asked in proportion to the supplier's tier. - Excel
Supplier Due Diligence Evidence Checklist
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole workbook: evidence requested in proportion to the supplier's tier. - Excel
Supplier Security Risk Register
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: The register as a whole: each supplier identified, tiered by the risk it brings, and managed to its tier's requirements. - Word
Supplier Security Review Report Template
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Parts B and G: security requirements set by tier and agreed with the supplier, recorded with the decision. - Word
Privileged Access Standard
in Privileged Access ManagementIts Framework References list this control. Supported by: Suppliers (PA-15). - Word
Privileged Access Request, Elevation & Revocation Procedure
in Privileged Access ManagementIts Framework References list this control. Supported by: Supplier engineers' accounts and windows. - Excel
ICT Third-Party Arrangements Register — Working Copy
in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: Arrangements and Providers sheets: the register of ICT suppliers and the contracts with them. - Excel
AI Vendor & Model Provider Security Questionnaire
in Generative AI SecurityIts Framework References list this control. Supported by: The workbook as a whole: information security in the supplier relationship and in the use of a cloud service. - Excel
Auditor (CPA Firm) Selection & Engagement Checklist
in SOC 2 Report ReadinessIts Framework References list this control. Supported by: Questions and Engagement Letter sheets: the questions put to a provider and the terms agreed with it before and at the start of the relationship, here with the CPA firm.