Your security is only as strong as your weakest supplier. Cloud platforms, IT service providers, payroll firms and software vendors all handle your data or connect to your systems. ISO 27001 supplier relationships controls make sure you choose, contract and monitor them with security in mind.
In the 2013 edition, this was Annex A.15 with five controls. The 2022 edition kept the topic in four organizational controls and added a new control for cloud services. This guide explains each one with practical steps.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.15 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.15.1.1 Information security policy for supplier relationships | 5.19 Information security in supplier relationships |
| A.15.1.2 Addressing security within supplier agreements | 5.20 Addressing information security within supplier agreements |
| A.15.1.3 ICT supply chain | 5.21 Managing information security in the ICT supply chain |
| A.15.2.1, A.15.2.2 Monitoring and managing changes to supplier services | 5.22 Monitoring, review and change management of supplier services |
| New in 2022 | 5.23 Information security for use of cloud services |
5.19 Information security in supplier relationships
First, define how you manage supplier risk. A supplier security process usually covers:
- Inventory: list suppliers and what data or systems they access.
- Tiering: rank them by risk, for example critical, high, medium and low.
- Due diligence: check security before you sign, using questionnaires, certificates or audit reports.
- Onboarding: grant only the access they need.
- Offboarding: remove access and recover or delete data when the contract ends.
Scale the effort to the risk. For example, a cleaning company needs a short check, while a cloud hosting provider needs a detailed review.
5.20 Supplier agreements
Next, write security into contracts. Typical clauses include:
- confidentiality and data protection duties;
- the security controls the supplier must maintain;
- breach notification within a set time, such as 24 hours;
- rules for subcontractors;
- your right to audit, or to receive independent reports such as ISO 27001 certificates or SOC 2 reports;
- data return and deletion at contract end;
- compliance with laws, such as India’s DPDP Act when the supplier processes personal data for you.
5.21 The ICT supply chain
Technology suppliers depend on their own suppliers. Attacks such as the 2020 SolarWinds compromise showed how one vendor update can reach thousands of customers. Therefore:
- ask critical vendors how they secure their build and update processes;
- request a software bill of materials (SBOM) for important software;
- verify software integrity, for example with signatures;
- track vulnerabilities in third-party components.
Read our SolarWinds case study for a real example of supply chain risk.
5.22 Monitoring and change management
Then keep watching after you sign. For example:
- review critical suppliers at least once a year;
- check service reports, incidents and certificate renewals;
- reassess risk when the service changes, such as a new data centre or subcontractor;
- hold regular service meetings that include security topics.
5.23 Cloud services (new)
This new control covers the full life cycle of cloud services: selection, use, management and exit. Key points include:
- understanding the shared responsibility model, so you know which controls are yours;
- checking where data is stored and who can access it;
- configuring services securely, for example with MFA and logging;
- planning how to exit and recover your data.
Supplier risk tiers: an example
| Tier | Example suppliers | Minimum checks |
|---|---|---|
| Critical | Cloud hosting, managed IT, payment processor | Certificate or audit report, contract clauses, annual review |
| High | SaaS with customer data, payroll | Security questionnaire, contract clauses, review every 1 to 2 years |
| Medium | Marketing tools with limited data | Short questionnaire and standard clauses |
| Low | Office supplies, cleaning | NDA and basic access rules |
What auditors check
- A supplier register with risk ratings.
- Due diligence records for critical suppliers.
- Security clauses in a sample of contracts.
- Evidence of periodic reviews.
- Cloud service configuration and exit plans.
FAQ
Is a supplier’s ISO 27001 certificate enough?
It is strong evidence, but check its scope. The certificate must cover the service you actually use.
Do we need to audit every supplier?
No. Focus on critical suppliers, and use certificates and questionnaires for the rest.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
