Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.21Managing information security in the ICT supply chain

What it means in practice

Processes and procedures must be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.

Distinct from supplier management generally: this is about the chain behind the supplier — the components, the code, the subcontractors and the upstream providers your direct supplier depends on.

The control asks the organisation to propagate requirements down the chain, to require suppliers to do the same, and to seek assurance that components and services are what they claim to be. Provenance matters here — the origin of software components, the integrity of what is delivered, and the ability to know which products contain which parts.

This is the control that events of recent years made unavoidable, and it is the hardest in Annex A to implement honestly, because visibility beyond the first tier depends on the cooperation of parties you have no contract with. A defensible implementation is usually risk-tiered: real depth for the few dependencies that could stop the business, contractual propagation for the rest.

How to put this in place

Much of today's software and cloud risk sits with the suppliers behind your suppliers. Looking only at the first tier leaves that risk invisible.

  1. Identify your critical technology suppliers.
  2. Ask each how it manages its own suppliers and components.
  3. Require suppliers to pass your security requirements to their own suppliers and to give notice of significant sub-contractor changes.
  4. For software you buy or build on, ask for vulnerability-handling commitments and, where it matters, a list of components.
  5. Record the answers and revisit them when the supplier is reassessed; see also A.5.19 to A.5.22.

Evidence an auditor usually looks for: questionnaire answers on supply chain practice, contract clauses on sub-contractors, and supplier notices of changes.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Word

    Supplier Security Assessment Procedure

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Step 10: the supplier's own suppliers that deliver our service.
  • Excel

    Tiered Supplier Security Questionnaire

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Domains Secure development, Vulnerabilities and patching, and Subcontractors and sub-processors.