Control A.5.19Information security in supplier relationships
Processes and procedures must be defined and implemented to manage the information security risks associated with the use of supplier products or services.
The parent of the supplier family — agreements in A.5.20, the ICT supply chain in A.5.21, monitoring in A.5.22, cloud in A.5.23 — and what it asks for is that supplier risk is managed as a process rather than handled contract by contract.
That means knowing which suppliers exist and what they have access to, assessing them proportionately to that access, and deciding what happens when an assessment finds something. A questionnaire returned and filed is not a process; a questionnaire that can produce a “no” is.
The hardest part in practice is discovery. Suppliers arrive through procurement, through expense claims, through a developer’s credit card, and an organisation that assesses only the suppliers procurement knows about is assessing the ones least likely to be the problem. Shadow arrangements are where the real third-party exposure usually sits.
How to put this in place
Every supplier that touches your information or services brings risk into your ISMS. Without a tiered view, effort goes to the wrong suppliers and the dangerous ones go unchecked.
- List your suppliers and note what information or service each one touches.
- Tier them by the risk they bring.
- Set the security requirements each tier must meet and write them into a supplier security policy.
- Assess higher tiers before contracting; A.5.22 covers reassessment on a cycle.
- Check that any certificate covers the service you actually buy; see also A.5.20 and A.5.21.
Evidence an auditor usually looks for: the tiered supplier register, completed assessments for a sample of higher-tier suppliers, and the supplier security policy.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for managing information security risk from suppliers among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.