Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.22Monitoring, review and change management of supplier services

What it means in practice

The organisation must regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

The control that turns a point-in-time assessment into an ongoing one. A supplier assessed at onboarding and never again is assessed as it was, not as it is — and services change, subcontractors change, and ownership changes.

Monitoring covers service delivery against the agreed levels, the supplier’s own security practice, and the changes to either. The evidence a supplier provides — audit reports, certifications, attestations — needs to be read rather than collected: a certificate’s scope may exclude the service you buy, and an assurance report’s exceptions are the part that matters.

Change management with suppliers is the element most often absent. A supplier that migrates to a new platform, a new region or a new subcontractor changes your risk, and unless the agreement under A.5.20 requires notice you will find out afterwards, if at all.

How to put this in place

A supplier assessed once at onboarding may change owner, sub-contractors or controls without you noticing. Scheduled review keeps your picture of the risk current.

  1. Set a reassessment cycle by tier, for example every 12 months for the highest.
  2. Review service reports and renewed certificates, checking their scope.
  3. Track any supplier findings to closure.
  4. Decide which changes at a supplier, such as new sub-contractors, systems or locations, or which incidents trigger an early reassessment.
  5. Record the conclusion of each review against the supplier.

Evidence an auditor usually looks for: reassessment dates against the tier cycle, findings tracked to closure, and renewed certificates and reports on file.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Word

    Third-Party Security Policy

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Monitoring: findings, reassessment on interval and change (TP-08, TP-09).
  • Word

    Supplier Security Assessment Procedure

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Stage 10: monitoring, findings and reassessment on interval and change.
  • Word

    Supplier Criticality & Tiering Model

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Reassessment intervals and monitoring by tier; when a supplier is tiered again.
  • Excel

    Supplier Due Diligence Evidence Checklist

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Evidence Items (in date, red flags) and the Review Summary's reassessment date.
  • Excel

    Supplier Security Risk Register

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Last assessed, next due, status, findings and deadlines: supplier security monitored, reviewed and reassessed on change.
  • Word

    Supplier Security Review Report Template

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Parts D, E and I: supplier security reviewed against evidence, findings tracked and the next review set.
  • Excel

    Third-Party Risk Dashboard

    in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: Assessments this quarter, due next quarter and overdue; open findings and their deadlines: supplier security monitored and reviewed.
  • PowerPoint

    Tabletop Scenario — Critical Supplier Outage

    in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck.
  • Word

    Patch Management Standard

    in Patch ManagementIts Framework References list this control. Supported by: PM-13: providers' patching checked every month.
  • Word

    Emergency Out-of-Band Patching Procedure

    in Patch ManagementIts Framework References list this control. Supported by: Services a provider patches.
  • Excel

    ICT Third-Party Arrangements Register — Working Copy

    in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: Arrangements and Checks sheets: the arrangements of each supplier's service are listed and their findings counted, for review.
  • Word

    System Description & Boundary Template

    in SOC 2 Report ReadinessIts Framework References list this control. Supported by: Watching what the providers named in the description deliver.