ISO 27001 A.5.22 - Monitoring, Review and Change Management of Supplier Services

Requirement

“The organization shall regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.”

Plain-language meaning

Supplier security does not end when the contract is signed. The organization must keep checking whether the supplier is delivering the agreed service securely, whether controls still work, and whether supplier changes create new risk.

Why this matters

Supplier relationships drift.

Examples:

• a supplier changes its hosting platform;
• service availability drops below the agreed level;
• the supplier changes support staff or remote access methods;
• a supplier incident affects the organization’s data or service;
• a subcontractor is introduced;
• security reports show recurring control failures;
• customer or regulatory requirements change.

If the organization does not monitor and manage these changes, the original agreement becomes stale.

Implementation guidance

1. Define supplier monitoring responsibilities

Each supplier should have an internal owner responsible for monitoring. For high-risk suppliers, the owner should coordinate with security, legal, procurement, IT, privacy, and business stakeholders.

Responsibilities should include:

• receiving supplier reports;
• reviewing service performance;
• reviewing security control evidence;
• tracking incidents and problems;
• evaluating supplier changes;
• escalating nonconformities;
• ensuring follow-up actions close.

2. Monitor service delivery and security controls

Monitoring should be proportionate to supplier risk.

Useful inputs include:

3. Manage supplier changes through risk review

Supplier changes should be assessed before approval where possible.

Examples of changes that should trigger review:

• service scope change;
• location or data transfer change;
• cloud or hosting change;
• subcontractor change;
• ownership or financial stability issue;
• access method change;
• technology platform change;
• security control change;
• incident response or support model change.

The review should consider changed business requirements, affected systems, legal commitments, customer obligations, risk treatment, and whether the contract must be updated.

4. Handle supplier incidents and nonconformities

The agreement should require supplier incident notification. Internally, the organization should have assigned responsibilities and procedures to:

• assess supplier incident reports;
• trigger the organization’s incident process if needed;
• communicate with stakeholders;
• request root cause and corrective action;
• track remediation;
• reassess supplier risk.

5. Use audit rights where appropriate

If the contract allows supplier audits, the organization should use that right when risk justifies it. This can include reviewing audit reports, performing supplier audits, or following up on findings.

Audit guidance

Auditors should verify that supplier monitoring is active, not just planned.

Audit tests:

• request supplier monitoring procedures;
• sample high-risk suppliers;
• check received supplier reports and internal review records;
• verify assigned reviewers have time and competence;
• check nonconformities and corrective actions;
• review supplier change records and approvals;
• verify risk reassessment after material changes;
• check whether legal/procurement/security stakeholders review contract changes;
• review supplier audit reports where audit rights exist;
• confirm supplier incidents are escalated and followed up.

The auditor should not accept an unsigned contract alone as evidence that A.5.22 operates.

Evidence examples

Strong evidence

• High-risk suppliers have scheduled reviews and named owners.
• Supplier reports are reviewed, not merely received.
• Supplier changes trigger risk reassessment and management approval.
• Nonconformities produce tracked corrective actions.
• Supplier incidents are linked to the organization’s incident process.
• Contract changes involve relevant stakeholders.
• Supplier audit findings are followed up.

Weak evidence

• Supplier reports are stored but not reviewed.
• No named owner for supplier monitoring.
• Changes are accepted by operations without risk review.
• Incidents are handled only by the supplier.
• Contract changes bypass security/legal/procurement review.
• SLA monitoring ignores information security practices.
• No evidence that supplier audit findings are resolved.

Common failures

Exam traps

• A.5.22 is about ongoing monitoring, review, evaluation, and change management.
• A signed agreement alone is not enough.
• Supplier reports must be reviewed and acted on.
• Supplier changes should trigger risk reassessment.
• Supplier incident reports may need to trigger the organization’s incident management process.
• Audit rights are useful only if used when risk justifies them.

Related controls and concepts

• A.5.19 Information Security in Supplier Relationships
• A.5.20 Addressing Information Security Within Supplier Agreements
• A.5.21 Managing Information Security in the ICT Supply Chain
• Risk Assessment
• Internal Audit
• Management Review
• Corrective Action Tracker
• Supplier Security Register
• Supplier Security Risk Assessment

KB-ready summary

A.5.22 requires active monitoring, review, evaluation, and change management of supplier security practices and service delivery. Practical evidence includes supplier reports, review records, change assessments, risk reassessments, incident follow-up, corrective actions, and supplier audit follow-up where applicable.

Templates and checklists

• Supplier Service Review and Change Log
• Supplier Security Register
• Corrective Action Tracker
• A.5.22 Audit Checklist