Control A.5.22Monitoring, review and change management of supplier services
The organisation must regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.
The control that turns a point-in-time assessment into an ongoing one. A supplier assessed at onboarding and never again is assessed as it was, not as it is — and services change, subcontractors change, and ownership changes.
Monitoring covers service delivery against the agreed levels, the supplier’s own security practice, and the changes to either. The evidence a supplier provides — audit reports, certifications, attestations — needs to be read rather than collected: a certificate’s scope may exclude the service you buy, and an assurance report’s exceptions are the part that matters.
Change management with suppliers is the element most often absent. A supplier that migrates to a new platform, a new region or a new subcontractor changes your risk, and unless the agreement under A.5.20 requires notice you will find out afterwards, if at all.
How to put this in place
A supplier assessed once at onboarding may change owner, sub-contractors or controls without you noticing. Scheduled review keeps your picture of the risk current.
- Set a reassessment cycle by tier, for example every 12 months for the highest.
- Review service reports and renewed certificates, checking their scope.
- Track any supplier findings to closure.
- Decide which changes at a supplier, such as new sub-contractors, systems or locations, or which incidents trigger an early reassessment.
- Record the conclusion of each review against the supplier.
Evidence an auditor usually looks for: reassessment dates against the tier cycle, findings tracked to closure, and renewed certificates and reports on file.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.