Addressing information security within supplier agreements

What the control asks

The information security requirements that matter for each supplier are to be set and agreed with that supplier, depending on the type of relationship. Purpose: make the agreed security level in each supplier relationship enforceable. Guidance: documented agreements should leave both parties clear about their security obligations. Terms to consider include: what information the supplier will receive or reach and by what means; its classification under the organization's scheme (5.10, 5.12, 5.13) and how that maps to the supplier's scheme; legal, regulatory and contractual obligations such as data protection, PII handling, intellectual property and copyright, and how compliance will be ensured; each party's duty to operate agreed controls (access control, performance review, monitoring, reporting, auditing) and the supplier's duty to meet the organization's requirements; acceptable and unacceptable use; how supplier staff are authorized and de-authorized, for instance an explicit list of named people; requirements for the supplier's ICT infrastructure with minimum requirements per information and access type; indemnities and remedies for failure; incident procedures, especially notification and joint remediation; training and awareness for specific procedures; subcontracting provisions such as flowing down obligations, a list of sub-suppliers and notice before changes; contacts including a security contact; lawful screening of supplier staff with responsibilities and what happens if screening is incomplete or raises concern; third-party attestations and independent reports on control effectiveness; a right to audit; periodic control effectiveness reports with timely correction of issues; defect and dispute resolution; backups matching the organization's needs for frequency, type and location; an alternate recovery site not exposed to the same threats, plus fallback controls; change management with advance notice and the option to refuse changes; physical security matching classification; protection in physical and logical transfer; termination terms on records, asset return, secure disposal and continuing confidentiality; secure destruction of the organization's information once no longer needed; and handover support at contract end to a new supplier or back in-house. A register of contracts, memoranda and information-sharing arrangements with outside parties (contracts, memoranda, information-sharing agreements) tracks where information goes, and agreements are regularly reviewed, validated and updated. Other information: agreements vary widely by organization and supplier type; ISO/IEC 27036 covers supplier agreements and ISO/IEC 19086 cloud service agreements.

Purpose in the standard’s terms, in our words: Makes the agreed security level for each supplier binding through written terms.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Supplier relationships security; Governance and ecosystem, Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
• A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
• Minimum security requirement templates per information type and access type used as the basis for individual contracts
• Supplier-provided attestations or independent control effectiveness reports and records of issues raised and corrected
• Lists of supplier personnel authorized to use organizational information and assets
• Contract clauses and evidence covering secure destruction of information and handover support at contract end

Where audits commonly find gaps

• Standard procurement terms are used with no security schedule for high-risk suppliers
• The right to audit or to receive assurance reports is missing from critical contracts
• No register of agreements exists, so the organization cannot say which parties hold its information
• Subcontracting clauses do not flow security obligations down to sub-suppliers

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (15.1.2) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.19 Information security in supplier relationships
• 5.21 Managing information security in the ICT supply chain
• 5.22 Monitoring, review and change management of supplier services

Read the five attributes All 93 controls