ISO 27001 A.5.19 - Information Security in Supplier Relationships

Requirement

“Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of supplier’s products or services.”

Plain-language meaning

The organization must manage information security risks created by suppliers, supplier products, and supplier services.

This includes suppliers with logical access, physical access, exposure to sensitive information, influence over business-critical decisions, or responsibility for systems, services, facilities, data, or support.

Why this matters

Suppliers can create risk even when they do not directly access systems.

Examples:

• remote support provider with privileged access;
• cloud service hosting customer data;
• cleaning contractor exposed to documents on desks;
• payroll provider processing employee data;
• software product used in a critical process;
• supplier data used for business-critical decisions;
• subcontractor performing part of the service;
• managed service provider with administrative control.

If supplier security is unmanaged, the organization imports risk without clear ownership.

Implementation guidance

1. Define supplier security policy and procedure

The organization should define:

• which suppliers require security assessment;
• supplier risk tiering;
• required due diligence;
• contract security requirements;
• access approval;
• information transfer rules;
• subcontractor expectations;
• monitoring and review;
• incident notification;
• termination and exit controls.

2. Maintain a master supplier list

The supplier list should identify:

3. Assess supplier risks

Supplier risk should consider:

• information classification;
• access to systems or premises;
• business criticality;
• legal and regulatory obligations;
• supplier location;
• subcontractors;
• operational resilience;
• incident history;
• assurance evidence;
• dependency and exit difficulty.

Risk assessment should determine what controls, agreements, monitoring, and reviews are needed.

4. Tailor controls to supplier exposure

Do not apply the same questionnaire to every supplier. That creates paperwork without control.

5. Address subcontractors

Suppliers may delegate work to other parties. The organization should know when this is allowed and what security requirements flow down.

Contracts should address:

• approval of subcontractors;
• equivalent security obligations;
• incident reporting;
• audit/assurance rights;
• data location and transfer;
• exit and deletion.

Audit guidance

Auditors should verify that supplier security is governed by policy, risk assessment, master supplier list, procedures, agreements, and periodic review.

Audit tests:

• request the master supplier list;
• sample suppliers by risk tier;
• verify supplier owner assignment;
• check supplier risk assessments;
• check agreements against exposure;
• verify information classification and access type;
• confirm subcontractor controls;
• check whether supplier reviews are performed;
• verify supplier incidents or changes are managed.

The auditor should reject a supplier process that only checks procurement cost and ignores security exposure.

Evidence examples

Strong evidence

• Supplier list includes service, owner, access type, information exposure, risk tier, and agreement reference.
• Supplier risks are assessed before onboarding and reviewed periodically.
• Agreements match the sensitivity and access involved.
• Subcontractor use is controlled.
• High-risk suppliers provide assurance evidence.
• Supplier access is tied to access control and identity processes.
• Supplier changes and incidents trigger review.

Weak evidence

• Procurement list exists but no security tiering.
• Supplier security depends on informal trust.
• No record of information exposed to suppliers.
• Contracts lack security requirements.
• Subcontractors are unknown.
• Supplier access is not reviewed.
• All suppliers complete the same superficial questionnaire.
• Supplier-generated business-critical information is not considered.

Common failures

Exam traps

• Supplier risk is not only logical system access.
• Suppliers can create risk through physical access, sensitive information exposure, products, services, or decision-support information.
• A procurement/vendor list is not enough; security exposure and risk tiering matter.
• Supplier procedures should consider subcontractors.
• Supplier controls should be proportional to information sensitivity and service impact.
• Supplier security must be implemented, not only written in a policy.

Related controls and concepts

• Risk Assessment
• Statement of Applicability
• A.5.14 Information Transfer
• A.5.15 Access Control
• A.5.16 Identity Management
• A.5.9 Inventory of Information and Other Associated Assets
• Information Transfer Rules Matrix
• Internal Audit

KB-ready summary

A.5.19 requires defined and implemented processes to manage supplier information security risks. A practical supplier security process includes a master supplier list, supplier owners, risk assessments, risk tiering, contractual controls, subcontractor controls, access control, and periodic review.

Templates and checklists

• Supplier Security Register
• Supplier Security Risk Assessment
• A.5.19 Audit Checklist
• Third-Party Information Transfer Agreement Checklist