Control A.5.21Managing information security in the ICT supply chain
Processes and procedures must be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.
Distinct from supplier management generally: this is about the chain behind the supplier — the components, the code, the subcontractors and the upstream providers your direct supplier depends on.
The control asks the organisation to propagate requirements down the chain, to require suppliers to do the same, and to seek assurance that components and services are what they claim to be. Provenance matters here — the origin of software components, the integrity of what is delivered, and the ability to know which products contain which parts.
This is the control that events of recent years made unavoidable, and it is the hardest in Annex A to implement honestly, because visibility beyond the first tier depends on the cooperation of parties you have no contract with. A defensible implementation is usually risk-tiered: real depth for the few dependencies that could stop the business, contractual propagation for the rest.
How to put this in place
Much of today's software and cloud risk sits with the suppliers behind your suppliers. Looking only at the first tier leaves that risk invisible.
- Identify your critical technology suppliers.
- Ask each how it manages its own suppliers and components.
- Require suppliers to pass your security requirements to their own suppliers and to give notice of significant sub-contractor changes.
- For software you buy or build on, ask for vulnerability-handling commitments and, where it matters, a list of components.
- Record the answers and revisit them when the supplier is reassessed; see also A.5.19 to A.5.22.
Evidence an auditor usually looks for: questionnaire answers on supply chain practice, contract clauses on sub-contractors, and supplier notices of changes.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.