Control A.5.20Addressing information security within supplier agreements
Relevant information security requirements must be established and agreed with each supplier based on the type of supplier relationship.
The contract is where the assessment in A.5.19 becomes enforceable. What belongs in it follows from the relationship: access rights and restrictions, incident notification obligations and timescales, the right to audit or to receive assurance, subcontracting conditions, data location and return, personnel screening, and what happens at the end.
“Based on the type of relationship” is the proportionality the control builds in — a cleaning contractor and a payroll processor do not need the same terms.
Two failures are chronic. Requirements agreed at signature and never revisited as the service changes; and incident notification clauses written without a timescale, which is worthless to an organisation with a 24-hour or 72-hour statutory reporting obligation of its own. A supplier who notifies you in a week has complied with the contract and destroyed your ability to comply with the law.
How to put this in place
What is not in the contract usually cannot be required later. Standard security clauses make a supplier's obligations enforceable.
- Decide the clause set for each A.5.19 tier: what information the supplier handles and how, confidentiality, incident notification times, audit or evidence rights, sub-contractor rules, and data return and deletion at exit.
- Have Legal and Procurement hold the standard wording.
- Check each new or renewed contract against it before signature.
- Record any deviation and who accepted the risk.
- Review the clauses yearly and after major incidents.
Evidence an auditor usually looks for: the clause set, a sample of higher-tier contracts showing the clauses, and records of deviations accepted.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists security requirements in supplier agreements among the documents auditors commonly expect for this control.