- See ISO 27002:2022 Control 5.19 for more information.
- See ISO 27001:2013 Annex A 15.1.1 for more information.
Strengthening Supplier Security: An In-Depth Look at ISO 27001 Annex A 5.19
ISO 27001:2022 Annex A Control 5.19 is about information security in supplier relationships. The objective here is protection of the organisation’s valuable assets that are accessible to or affected by suppliers.
We also recommend that you also consider other key relationships here too, for example partners if they are not suppliers but also have an impact on your assets that might not simply be covered by a contract alone.
This is an important part of the information security management system (ISMS) especially if you’d like to achieve ISO 27001 certification. Lets understand those requirements and what they mean in a bit more depth now.
Suppliers are used for two main reasons; one: you want them to do work that you have chosen not to do internally yourself, or; two: you can’t easily do the work as well or as cost effectively as the suppliers.
There are many important things to consider in approach to supplier selection and management but one size does not fit all and some suppliers will be more important than others. As such your controls and policies should reflect that too and a segmentation of the supply chain is sensible; we advocate four categories of supplier based on the value and risk in the relationship. These range from those who are business critical through to other vendors who have no material impact on your organisation.
Purpose of ISO 27001:2022 Annex A 5.19
ISO 27001:2002 Annex A Control 5.19 concerns itself with an organisation’s obligation to ensure that, when using supplier-side products and services (including cloud service providers), adequate consideration is given to the level of risk inherent in using external systems, and the consequential impact that may have on their own information security adherence.
A good policy describes the supplier segmentation, selection, management, exit, how information assets around suppliers are controlled in order to mitigate the associated risks, yet still enable the business goals and objectives to be achieved. Smart organisations will wrap their information security policy for suppliers into a broader relationship framework and avoid just concentrating on security per se, looking to the other aspects as well.
Annex A Control 5.19 is a preventative control that modifies risk by maintaining procedures that address inherent security risks associated with the use of products and services provided by third parties.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Who Has Ownership of Annex A 5.19?
Whilst Control ISO 27001 Annex A 5.19 contains a lot of guidance on the use of ICT services, the broader scope of the control encompasses many other aspects of an organisation’s relationship with its supplier base, including supplier types, logistics, utilities, financial services and infrastructure components).
As such, ownership of Annex A Control 5.19 should rest with a member of senior management that oversees an organisation’s commercial operation, and maintains a direct relationship with an organisation’s suppliers, such as a Chief Operating Officer.
General Guidance on ISO 27001:2022 Annex A 5.19
Compliance with Annex A Control 5.19 involves adhering to what’s known as a ‘topic-specific’ approach to information security in supplier relationships.
An organisation may want suppliers to access and contribute to certain high value information assets (e.g. software code development, accounting payroll information). They would therefore need to have clear agreements of exactly what access they are allowing them, so they can control the security around it.
This is especially important with more and more information management, processing and technology services being outsourced. That means having a place to show management of the relationship is happening; contracts, contacts, incidents, relationship activity and risk management etc. Where the supplier is also intimately involved in the organisation, but may not have its own certified ISMS, then ensuring the supplier staff are educated and aware of security, trained on your policies etc is also worth demonstrating compliance around.
Topic-specific approaches encourage organisations to create supplier-related policies that are tailored towards individual business functions, rather than adhering to a blanket supplier management policy that applies to any and all third party relationships across an organisation’s commercial operation.
It’s important to note that ISO 27001 Annex A Control 5.19 asks the organisation to implement policies and procedures that not only govern the organisation’s use of supplier resources and cloud platforms, but also form the basis of how they expect their suppliers to conduct themselves prior to and throughout the term of the commercial relationship.
As such, Annex A Control 5.19 can be viewed as the essential qualifying document that dictates how information security governance is handled over the course of a supplier contract.
ISO 27001 Annex A Control 5.19 contains 14 main guidance points to be adhered to:
1) Maintain an accurate record of supplier types (e.g. financial services, ICT hardware, telephony) that have the potential to affect information security integrity.
Compliance – Draft a list of any and all suppliers that your organisation works with, categorise them according to their business function and add categories to said supplier types as and when required.
2) Understand how to vet suppliers, based on the level of risk inherent for their supplier type.
Compliance – Different supplier types will require different due diligence checks. Consider using vetting methods on a supplier-by-supplier basis (e.g. industry references, financial statements, onsite assessments, sector-specific certifications such as Microsoft Partnerships).
3) Identify suppliers that have pre-existing information security controls in place.
Compliance – Ask to see copies of suppliers’ relevant information security governance procedures, in order to evaluate the risk to your own organisation. If they don’t have any, it’s not a good sign.
4) Identify and define the specific areas of your organisation’s ICT infrastructure that your suppliers will be able to either access, monitor or make use of themselves.
Compliance – It’s important to establish from the outset precisely how your suppliers are going to interact with your ICT assets – be they physical or virtual – and what levels of access they’re granted in accordance with their contractual obligations.
5) Define how the suppliers’ own ICT infrastructure can impact upon your own data, and that of your customers.
Compliance – An organisation’s first obligation is to its own set of information security standards. Supplier ICT assets need to be reviewed in accordance with their potential to affect up-time and integrity throughout your organisation.
6) Identify and manage the various information security risks attached to:
a. Supplier use of confidential information or protected assets (e.g. limited to malicious use and/or criminal intent).
b. Faulty supplier hardware or malfunctioning software platform associated with on-premise or cloud based services.
Compliance – Organisations need to be continually mindful of the information security risks associated with catastrophic events, such as nefarious supplier-side user activity or major unforeseen software incidents, and their impact on organisational information security.
7) Monitor information security compliance on a topic specific or supplier type basis.
Compliance – Organisation’s need to appreciate the information security implications inherent within each supplier type, and adjust their monitoring activity to accommodate varying levels of risk.
8) Limit the amount of damage and/or disruption caused through non-compliance.
Compliance – Supplier activity should be monitored in an appropriate manner, and to varying degrees, in accordance with its risk level. Where non-compliance is discovered, either proactively or re-actively, immediate action should be taken.
9) Maintain a robust incident management procedure that addresses a reasonable amount of contingencies.
Compliance – Organisations should understand precisely how to react when faced with a broad range of events relating to the supply of third party products and services, and outline remedial actions that include both the supplier and the organisation.
10) Enact measures that cater to the availability and processing of the supplier’s information, wherever it’s used, thereby ensuring the integrity of the organisation’s own information.
Compliance – Steps should be taken to ensure that supplier systems and data are handled in a way that doesn’t compromise on the availability and security of the organisation’s own systems and information.
11) Draft a thorough training plan that offers guidance on how staff should interact with supplier personnel and information on a supplier-by-supplier basis, or on a type-by-type basis.
Compliance – Training should cover the full spectrum of governance between an organisation and its suppliers, including engagement, granular risk management controls and topic-specific procedures.
12) Understand and manage the level of risk inherent when transferring information and physical and virtual assets between the organisation and their suppliers.
Compliance – Organisations should map out each stage of the transfer process and educate staff as to the risks associated with moving assets and information from one source to another.
13) Ensure that supplier relationships are terminated with information security in mind, including removing access rights and the ability to access organisational information.
Compliance – Your ICT teams should have a clear understanding of how to revoke a supplier’s access to information, including:
- Granular analysis of any associated domain and/or cloud-based accounts.
- Distribution of intellectual property.
- The porting of information between suppliers, or back to your organisation.
- Records management.
- Returning assets to their original owner.
- Adequate disposal of physical and virtual assets, including information.
- Adherence to any contractual requirements, including confidentiality clauses and/or external agreements.
14) Outline precisely how you expect the supplier to conduct themselves regarding physical and virtual security measures.
Compliance – Organisations should set clear expectations from the outset of any commercial relationship, that specify how supplier-side personnel are expected to conduct themselves when interacting with your staff or any relevant assets.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
Supplementary Guidance on Annex A 5.19
ISO acknowledges that it’s not always possible to impose a full set of policies on a supplier that meet each and every requirement from the above list as ISO 27001 Annex A Control 5.19 intends, especially when dealing with rigid public sector organisations.
That being said, Annex A Control 5.19 clearly states that organisations should use the above guidance when forming relationships with suppliers, and consider non-adherence on a case-by-case basis.
Where full compliance isn’t achievable, Annex A Control 5.19 gives organisations leeway by recommending “compensating controls” that achieve adequate levels of risk management, based on an organisation’s unique circumstances.
What Are the Changes From ISO 27001:2013?
ISO 27001:2022 Annex A 5.19 replaces ISO 27001:2013 Annex A 15.1.1 (Information security policy for supplier relationships).
ISO 27001:2022 Annex A 5.19 broadly adheres to the same underlying concepts contained in the 2013 control, but does contain several additional guidance areas that are either omitted from ISO 27001:2013 Annex A 5.1.1, or at the very least not covered in as much detail, including:
- The vetting of suppliers based on their supplier type and risk level.
- The need to ensure the integrity of supplier information in order to secure their own data, and ensure business continuity.
- The various steps required when ending a supplier relationship, including the decommissioning of access rights, IP distribution, contractual agreements etc.
ISO 27001:2022 Annex A 5.19 is also explicit in acknowledging the highly variable nature of supplier relationships (based on type, sector and risk level), and gives organisations a certain degree of leeway when considering the possibility of non-compliance of any given guidance point, based on the nature of the relationship (see ‘Supplementary Guidance’ above).
Table of All ISO 27001:2022 Annex A Controls
In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Organisational Controls | Annex A 5.1 |
Annex A 5.1.1 Annex A 5.1.2 |
Policies for Information Security |
| Organisational Controls | Annex A 5.2 | Annex A 6.1.1 | Information Security Roles and Responsibilities |
| Organisational Controls | Annex A 5.3 | Annex A 6.1.2 | Segregation of Duties |
| Organisational Controls | Annex A 5.4 | Annex A 7.2.1 | Management Responsibilities |
| Organisational Controls | Annex A 5.5 | Annex A 6.1.3 | Contact With Authorities |
| Organisational Controls | Annex A 5.6 | Annex A 6.1.4 | Contact With Special Interest Groups |
| Organisational Controls | Annex A 5.7 | NEW | Threat Intelligence |
| Organisational Controls | Annex A 5.8 |
Annex A 6.1.5 Annex A 14.1.1 |
Information Security in Project Management |
| Organisational Controls | Annex A 5.9 |
Annex A 8.1.1 Annex A 8.1.2 |
Inventory of Information and Other Associated Assets |
| Organisational Controls | Annex A 5.10 |
Annex A 8.1.3 Annex A 8.2.3 |
Acceptable Use of Information and Other Associated Assets |
| Organisational Controls | Annex A 5.11 | Annex A 8.1.4 | Return of Assets |
| Organisational Controls | Annex A 5.12 | Annex A 8.2.1 | Classification of Information |
| Organisational Controls | Annex A 5.13 | Annex A 8.2.2 | Labelling of Information |
| Organisational Controls | Annex A 5.14 |
Annex A 13.2.1 Annex A 13.2.2 Annex A 13.2.3 |
Information Transfer |
| Organisational Controls | Annex A 5.15 |
Annex A 9.1.1 Annex A 9.1.2 |
Access Control |
| Organisational Controls | Annex A 5.16 | Annex A 9.2.1 | Identity Management |
| Organisational Controls | Annex A 5.17 |
Annex A 9.2.4 Annex A 9.3.1 Annex A 9.4.3 |
Authentication Information |
| Organisational Controls | Annex A 5.18 |
Annex A 9.2.2 Annex A 9.2.5 Annex A 9.2.6 |
Access Rights |
| Organisational Controls | Annex A 5.19 | Annex A 15.1.1 | Information Security in Supplier Relationships |
| Organisational Controls | Annex A 5.20 | Annex A 15.1.2 | Addressing Information Security Within Supplier Agreements |
| Organisational Controls | Annex A 5.21 | Annex A 15.1.3 | Managing Information Security in the ICT Supply Chain |
| Organisational Controls | Annex A 5.22 |
Annex A 15.2.1 Annex A 15.2.2 |
Monitoring, Review and Change Management of Supplier Services |
| Organisational Controls | Annex A 5.23 | NEW | Information Security for Use of Cloud Services |
| Organisational Controls | Annex A 5.24 | Annex A 16.1.1 | Information Security Incident Management Planning and Preparation |
| Organisational Controls | Annex A 5.25 | Annex A 16.1.4 | Assessment and Decision on Information Security Events |
| Organisational Controls | Annex A 5.26 | Annex A 16.1.5 | Response to Information Security Incidents |
| Organisational Controls | Annex A 5.27 | Annex A 16.1.6 | Learning From Information Security Incidents |
| Organisational Controls | Annex A 5.28 | Annex A 16.1.7 | Collection of Evidence |
| Organisational Controls | Annex A 5.29 |
Annex A 17.1.1 Annex A 17.1.2 Annex A 17.1.3 |
Information Security During Disruption |
| Organisational Controls | Annex A 5.30 | NEW | ICT Readiness for Business Continuity |
| Organisational Controls | Annex A 5.31 |
Annex A 18.1.1 Annex A 18.1.5 |
Legal, Statutory, Regulatory and Contractual Requirements |
| Organisational Controls | Annex A 5.32 | Annex A 18.1.2 | Intellectual Property Rights |
| Organisational Controls | Annex A 5.33 | Annex A 18.1.3 | Protection of Records |
| Organisational Controls | Annex A 5.34 | Annex A 18.1.4 | Privacy and Protection of PII |
| Organisational Controls | Annex A 5.35 | Annex A 18.2.1 | Independent Review of Information Security |
| Organisational Controls | Annex A 5.36 |
Annex A 18.2.2 Annex A 18.2.3 |
Compliance With Policies, Rules and Standards for Information Security |
| Organisational Controls | Annex A 5.37 | Annex A 12.1.1 | Documented Operating Procedures |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| People Controls | Annex A 6.1 | Annex A 7.1.1 | Screening |
| People Controls | Annex A 6.2 | Annex A 7.1.2 | Terms and Conditions of Employment |
| People Controls | Annex A 6.3 | Annex A 7.2.2 | Information Security Awareness, Education and Training |
| People Controls | Annex A 6.4 | Annex A 7.2.3 | Disciplinary Process |
| People Controls | Annex A 6.5 | Annex A 7.3.1 | Responsibilities After Termination or Change of Employment |
| People Controls | Annex A 6.6 | Annex A 13.2.4 | Confidentiality or Non-Disclosure Agreements |
| People Controls | Annex A 6.7 | Annex A 6.2.2 | Remote Working |
| People Controls | Annex A 6.8 |
Annex A 16.1.2 Annex A 16.1.3 |
Information Security Event Reporting |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Physical Controls | Annex A 7.1 | Annex A 11.1.1 | Physical Security Perimeters |
| Physical Controls | Annex A 7.2 |
Annex A 11.1.2 Annex A 11.1.6 |
Physical Entry |
| Physical Controls | Annex A 7.3 | Annex A 11.1.3 | Securing Offices, Rooms and Facilities |
| Physical Controls | Annex A 7.4 | NEW | Physical Security Monitoring |
| Physical Controls | Annex A 7.5 | Annex A 11.1.4 | Protecting Against Physical and Environmental Threats |
| Physical Controls | Annex A 7.6 | Annex A 11.1.5 | Working In Secure Areas |
| Physical Controls | Annex A 7.7 | Annex A 11.2.9 | Clear Desk and Clear Screen |
| Physical Controls | Annex A 7.8 | Annex A 11.2.1 | Equipment Siting and Protection |
| Physical Controls | Annex A 7.9 | Annex A 11.2.6 | Security of Assets Off-Premises |
| Physical Controls | Annex A 7.10 |
Annex A 8.3.1 Annex A 8.3.2 Annex A 8.3.3 Annex A 11.2.5 |
Storage Media |
| Physical Controls | Annex A 7.11 | Annex A 11.2.2 | Supporting Utilities |
| Physical Controls | Annex A 7.12 | Annex A 11.2.3 | Cabling Security |
| Physical Controls | Annex A 7.13 | Annex A 11.2.4 | Equipment Maintenance |
| Physical Controls | Annex A 7.14 | Annex A 11.2.7 | Secure Disposal or Re-Use of Equipment |
| Annex A Control Type | ISO/IEC 27001:2022 Annex A Identifier | ISO/IEC 27001:2013 Annex A Identifier | Annex A Name |
|---|---|---|---|
| Technological Controls | Annex A 8.1 |
Annex A 6.2.1 Annex A 11.2.8 |
User Endpoint Devices |
| Technological Controls | Annex A 8.2 | Annex A 9.2.3 | Privileged Access Rights |
| Technological Controls | Annex A 8.3 | Annex A 9.4.1 | Information Access Restriction |
| Technological Controls | Annex A 8.4 | Annex A 9.4.5 | Access to Source Code |
| Technological Controls | Annex A 8.5 | Annex A 9.4.2 | Secure Authentication |
| Technological Controls | Annex A 8.6 | Annex A 12.1.3 | Capacity Management |
| Technological Controls | Annex A 8.7 | Annex A 12.2.1 | Protection Against Malware |
| Technological Controls | Annex A 8.8 |
Annex A 12.6.1 Annex A 18.2.3 |
Management of Technical Vulnerabilities |
| Technological Controls | Annex A 8.9 | NEW | Configuration Management |
| Technological Controls | Annex A 8.10 | NEW | Information Deletion |
| Technological Controls | Annex A 8.11 | NEW | Data Masking |
| Technological Controls | Annex A 8.12 | NEW | Data Leakage Prevention |
| Technological Controls | Annex A 8.13 | Annex A 12.3.1 | Information Backup |
| Technological Controls | Annex A 8.14 | Annex A 17.2.1 | Redundancy of Information Processing Facilities |
| Technological Controls | Annex A 8.15 |
Annex A 12.4.1 Annex A 12.4.2 Annex A 12.4.3 |
Logging |
| Technological Controls | Annex A 8.16 | NEW | Monitoring Activities |
| Technological Controls | Annex A 8.17 | Annex A 12.4.4 | Clock Synchronization |
| Technological Controls | Annex A 8.18 | Annex A 9.4.4 | Use of Privileged Utility ProgramsAccess Rights |
| Technological Controls | Annex A 8.19 |
Annex A 12.5.1 Annex A 12.6.2 |
Installation of Software on Operational Systems |
| Technological Controls | Annex A 8.20 | Annex A 13.1.1 | Networks Security |
| Technological Controls | Annex A 8.21 | Annex A 13.1.2 | Security of Network Services |
| Technological Controls | Annex A 8.22 | Annex A 13.1.3 | Segregation of Networks |
| Technological Controls | Annex A 8.23 | NEW | Web filtering |
| Technological Controls | Annex A 8.24 |
Annex A 10.1.1 Annex A 10.1.2 |
Use of Cryptography |
| Technological Controls | Annex A 8.25 | Annex A 14.2.1 | Secure Development Life Cycle |
| Technological Controls | Annex A 8.26 |
Annex A 14.1.2 Annex A 14.1.3 |
Application Security Requirements |
| Technological Controls | Annex A 8.27 | Annex A 14.2.5 | Secure System Architecture and Engineering PrinciplesLearning From Information Security Incidents |
| Technological Controls | Annex A 8.28 | NEW | Secure Coding |
| Technological Controls | Annex A 8.29 |
Annex A 14.2.8 Annex A 14.2.9 |
Security Testing in Development and Acceptance |
| Technological Controls | Annex A 8.30 | Annex A 14.2.7 | Outsourced Development |
| Technological Controls | Annex A 8.31 |
Annex A 12.1.4 Annex A 14.2.6 |
Separation of Development, Test and Production Environments |
| Technological Controls | Annex A 8.32 |
Annex A 12.1.2 Annex A 14.2.2 Annex A 14.2.3 Annex A 14.2.4 |
Change Management |
| Technological Controls | Annex A 8.33 | Annex A 14.3.1 | Test Information |
| Technological Controls | Annex A 8.34 | Annex A 12.7.1 | Protection of Information Systems During Audit Testing |
[case_study_slider ids=”88859,101932,92016″ autoplay=”true” autoplay_speed=”5000″]
How Does ISMS.online Help With Supplier Relationships?
ISMS.online has made this control objective very easy by providing evidence that your relationships are carefully elected, managed well in life including being monitored and reviewed. Our easy-to-use Accounts relationships (e.g. supplier) area does just that. The collaborative projects work spaces is great for important supplier on-boarding, joint initiatives, off-boarding etc all of which the auditor can also view with ease when required.
ISMS.online has also made this control objective easier for your organisation by enabling you to provide evidence that the supplier has formally committed to complying with the requirements and has understood its responsibilities for information security through our Policy Packs. Policy Packs are ideal where the organisation has specific policies & controls it wants supplier staff to follow and take confidence they have read them and committed to comply – beyond the broader agreements between customer and supplier.
Depending on the nature of the change (i.e. for more material changes) there may be a broader requirement to align with A.6.1.5 information Security in Project Management.
Using ISMS.online You Can:
- Quickly implement an Information Security Management System (ISMS).
- Easily manage the documentation of your ISMS.
- Streamline compliance with all relevant standards.
- Manage all aspects of information security, from risk management to security awareness training.
- Effectively communicate throughout your organisation using our built-in communication functionality.
Get in touch today to book a demo.
