Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.20Addressing information security within supplier agreements

What it means in practice

Relevant information security requirements must be established and agreed with each supplier based on the type of supplier relationship.

The contract is where the assessment in A.5.19 becomes enforceable. What belongs in it follows from the relationship: access rights and restrictions, incident notification obligations and timescales, the right to audit or to receive assurance, subcontracting conditions, data location and return, personnel screening, and what happens at the end.

“Based on the type of relationship” is the proportionality the control builds in — a cleaning contractor and a payroll processor do not need the same terms.

Two failures are chronic. Requirements agreed at signature and never revisited as the service changes; and incident notification clauses written without a timescale, which is worthless to an organisation with a 24-hour or 72-hour statutory reporting obligation of its own. A supplier who notifies you in a week has complied with the contract and destroyed your ability to comply with the law.

How to put this in place

What is not in the contract usually cannot be required later. Standard security clauses make a supplier's obligations enforceable.

  1. Decide the clause set for each A.5.19 tier: what information the supplier handles and how, confidentiality, incident notification times, audit or evidence rights, sub-contractor rules, and data return and deletion at exit.
  2. Have Legal and Procurement hold the standard wording.
  3. Check each new or renewed contract against it before signature.
  4. Record any deviation and who accepted the risk.
  5. Review the clauses yearly and after major incidents.

Evidence an auditor usually looks for: the clause set, a sample of higher-tier contracts showing the clauses, and records of deviations accepted.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Excel

    Mandatory ISMS Documentation Checklist

    in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists security requirements in supplier agreements among the documents auditors commonly expect for this control.
  • Word

    Third-Party Security Policy

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Contracting: the tier's security clauses in every contract (TP-07, TP-10, TP-11).
  • Word

    Supplier Contract Security Clause Library

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Whole library: security requirements agreed with each supplier according to its tier.
  • Word

    Standard Security Commitments Schedule

    in Security Questionnaire & Due Diligence ResponseIts Framework References list this control. Supported by: The whole schedule: information security requirements agreed with a customer, in a contract exhibit.
  • Word

    Business Associate Agreement Security Terms

    in HIPAA Security Rule ReadinessIts Framework References list this control. Supported by: The agreement terms that address supplier security: the form lists them and the form's result is kept with the agreement.