A.5.19 Audit Checklist

When to use this

Use this during internal audits to verify that supplier information security risks are identified, assessed, controlled, and reviewed.

Checklist

• Supplier security policy or principles exist.
• Supplier security procedure exists.
• Master supplier list exists.
• Supplier owners are assigned.
• Supplier information exposure is recorded.
• Supplier physical/logical access is recorded.
• Supplier risk assessments are performed.
• Suppliers are risk-tiered.
• Agreements include security requirements appropriate to exposure.
• Subcontractor use is controlled.
• Supplier access is tied to access and identity controls.
• Supplier assurance or review is performed based on risk.
• Supplier incidents and changes trigger review.

Related notes

• A.5.19 Information Security in Supplier Relationships
• A.5.19 Audit Evidence Pack
• Supplier Security Register
• Supplier Security Risk Assessment