A.5.20 Audit Checklist

When to use this

Use this during internal audits to verify that supplier security requirements are formally agreed and appropriate to the supplier relationship.

Checklist

• Supplier risk assessment exists.
• Supplier agreement or contract exists.
• Security requirements match supplier access, information exposure, and service criticality.
• Agreement includes confidentiality and information handling requirements.
• Agreement includes access control and authentication requirements where relevant.
• Agreement includes incident notification requirements.
• Agreement includes subcontractor and flow-down requirements where relevant.
• Agreement includes termination, return, deletion, or exit requirements.
• Control responsibilities between parties are clear.
• Agreement is approved by authorized representatives.
• Supplier access did not begin before required controls were agreed.
• Deviations are documented, justified, approved, and reviewed.

Related notes

• A.5.20 Addressing Information Security Within Supplier Agreements
• A.5.20 Audit Evidence Pack
• Supplier Security Agreement Requirements Checklist
• Supplier Security Responsibility Matrix