Information security in supplier relationships

What the control asks

The organization is to define and run processes and procedures that manage the information security risks arising from using suppliers' products or services. Purpose: keep security in dealings with suppliers at the level both sides agreed. Guidance: set a topic-specific supplier relationship policy and share it with relevant parties. Processes, including those applying to cloud service providers and those the organization requires suppliers to follow when use of a product or service starts or ends, should cover: identifying and recording the kinds of supplier (ICT services, logistics, utilities, financial services, infrastructure components) that could affect confidentiality, integrity or availability; deciding how suppliers are evaluated and chosen according to sensitivity, using market analysis, references, document review, on-site assessment or certification; choosing and reviewing products and services with adequate controls, especially the accuracy and completeness of controls protecting that the supplier's own information and processing stay intact; defining which information, ICT services and physical infrastructure suppliers may access, monitor, control or use; defining the supplier-provided infrastructure components and services that could affect the organization; assessing and managing risks from suppliers' use of the organization's assets (including malicious supplier staff) and from faulty or vulnerable products, components or services; monitoring compliance per supplier and access type, which can involve independent reviews and validating products; dealing with supplier non-compliance however it is found; handling supplier-related incidents and contingencies with each side's responsibilities; resilience, recovery and contingency so the supplier's information and processing stay available; awareness and training for staff who deal with supplier personnel; managing transfers of information and assets securely during transition; secure termination covering removal of access, information handling, ownership of intellectual property created, portability on change of supplier or insourcing, records management, returning assets, disposing of them securely and keeping confidentiality going afterwards; and the personnel and physical security expected of supplier staff and sites. Plans for continuing if a supplier can no longer deliver, for example by pre-identifying or routinely using alternatives, should be considered. Other information: where requirements cannot be imposed, use this guidance in choosing the supplier and add compensating controls based on risk; NDAs or cryptography can protect confidentiality, cross-border data access raises privacy risk, legal responsibility for the information stays with the organization, and vulnerable supplier components can harm the organization or others; ISO/IEC 27036-2 has more detail.

Purpose in the standard’s terms, in our words: Keeps security in supplier dealings at the level agreed with the supplier.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Supplier relationships security; Governance and ecosystem, Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The topic-specific supplier relationship policy and its communication record
• A supplier inventory categorized by type and by the information, services and infrastructure each can access
• Supplier due diligence and selection records such as questionnaires, certifications, references and on-site assessment reports, scaled to sensitivity
• Supplier risk assessments covering misuse of organizational assets and product or component vulnerabilities
• Supplier monitoring and non-compliance records with remediation actions
• Exit and contingency plans for critical suppliers covering access removal, data return or destruction, portability, intellectual property and alternative supply

Where audits commonly find gaps

• Suppliers are onboarded by procurement without any security assessment
• Cloud service providers are not treated as suppliers under the policy
• No exit plan exists for critical suppliers, so access and data linger after termination
• Monitoring stops after onboarding and relies solely on an annual certificate

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (15.1.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.20 Addressing information security within supplier agreements
• 5.21 Managing information security in the ICT supply chain
• 5.22 Monitoring, review and change management of supplier services

Read the five attributes All 93 controls