ISO 27002:2022, Control 5.19 – Information Security in Supplier Relationships

Ownership of Control 5.19

Whilst Control 5.19 contains a lot of guidance on the use of ICT services, the broader scope of the control encompasses many other aspects of an organisation’s relationship with its supplier base, including supplier types, logistics, utilities, financial services and infrastructure components).

As such, ownership of Control 5.19 should rest with a member of senior management that oversees an organisation’s commercial operation, and maintains a direct relationship with an organisation’s suppliers, such as a Chief Operating Officer.

General Guidance

Compliance with Control 5.19 involves adhering to what’s known as a ‘topic-specific’ approach to information security in supplier relationships.

Topic-specific approaches encourage organisations to create supplier-related policies that are tailored towards individual business functions, rather than adhering to a blanket supplier management policy that applies to any and all third party relationships across an organisation’s commercial operation.

It’s important to note that Control 5.19 asks the organisation to implement policies and procedures that not only govern the organisation’s use of supplier resources and cloud platforms, but also form the basis of how they expect their suppliers to conduct themselves prior to and throughout the term of the commercial relationship.

As such, Control 5.19 can be viewed as the essential qualifying document that dictates how information security governance is handled over the course of a supplier contract.

Control 5.19 contains 14 main guidance points to be adhered to:

1) Maintain an accurate record of supplier types (e.g. financial services, ICT hardware, telephony) that have the potential to affect information security integrity.

Compliance – Draft a list of any and all suppliers that your organisation works with, categorise them according to their business function and add categories to said supplier types as and when required.

2) Understand how to vet suppliers, based on the level of risk inherent for their supplier type.

Compliance – Different supplier types will require different due diligence checks. Consider using vetting methods on a supplier-by-supplier basis (e.g. industry references, financial statements, onsite assessments, sector-specific certifications such as Microsoft Partnerships).

3) Identify suppliers that have pre-existing information security controls in place.

Compliance – Ask to see copies of suppliers’ relevant information security governance procedures, in order to evaluate the risk to your own organisation. If they don’t have any, it’s not a good sign.

4) Identify and define the specific areas of your organisation’s ICT infrastructure that your suppliers will be able to either access, monitor or make use of themselves.

Compliance – It’s important to establish from the outset precisely how your suppliers are going to interact with your ICT assets – be they physical or virtual – and what levels of access they’re granted in accordance with their contractual obligations.

5) Define how the suppliers’ own ICT infrastructure can impact upon your own data, and that of your customers.

Compliance – An organisation’s first obligation is to its own set of information security standards. Supplier ICT assets need to be reviewed in accordance with their potential to affect uptime and integrity throughout your organisation.

6) Identify and manage the various information security risks attached to:

a. Supplier use of confidential information or protected assets (e.g. limited to malicious use and/or criminal intent).

b. Faulty supplier hardware or malfunctioning software platform associated with on-premise or cloud based services.

Compliance – Organisations need to be continually mindful of the information security risks associated with catastrophic events, such as nefarious supplier-side user activity or major unforeseen software incidents, and their impact on organisational information security.

General Guidance Continued

7) Monitor information security compliance on a topic specific or supplier type basis.

Compliance – Organisation’s need to appreciate the information security implications inherent within each supplier type, and adjust their monitoring activity to accommodate varying levels of risk.

8) Limit the amount of damage and/or disruption caused through non-compliance.

Compliance – Supplier activity should be monitored in an appropriate manner, and to varying degrees, in accordance with its risk level. Where non-compliance is discovered, either proactively or reactively, immediate action should be taken.

9) Maintain a robust incident management procedure that addresses a reasonable amount of contingencies.

Compliance – Organisations should understand precisely how to react when faced with a broad range of events relating to the supply of third party products and services, and outline remedial actions that include both the supplier and the organisation.

10) Enact measures that cater to the availability and processing of the supplier’s information, wherever it’s used, thereby ensuring the integrity of the organisation’s own information.

Compliance – Steps should be taken to ensure that supplier systems and data are handled in a way that doesn’t compromise on the availability and security of the organisation’s own systems and information.

11) Draft a thorough training plan that offers guidance on how staff should interact with supplier personnel and information on a supplier-by-supplier basis, or on a type-by-type basis.

Compliance – Training should cover the full spectrum of governance between an organisation and its suppliers, including engagement, granular risk management controls and topic-specific procedures.

12) Understand and manage the level of risk inherent when transferring information and physical and virtual assets between the organisation and their suppliers.

Compliance – Organisations should map out each stage of the transfer process and educate staff as to the risks associated with moving assets and information from one source to another.

13) Ensure that supplier relationships are terminated with information security in mind, including removing access rights and the ability to access organisational information.

Compliance – Your ICT teams should have a clear understanding of how to revoke a supplier’s access to information, including:

• Granular analysis of any associated domain and/or cloud-based accounts.
• Distribution of intellectual property.
• The porting of information between suppliers, or back to your organisation.
• Records management.
• Returning assets to their original owner.
• Adequate disposal of physical and virtual assets, including information.
• Adherence to any contractual requirements, including confidentiality clauses and/or external agreements.

14) Outline precisely how you expect the supplier to conduct themselves regarding physical and virtual security measures.

Compliance – Organisations should set clear expectations from the outset of any commercial relationship, that specify how supplier-side personnel are expected to conduct themselves when interacting with your staff or any relevant assets.

Supplementary Guidance

ISO acknowledges that it’s not always possible to impose a full set of policies on a supplier that meet each and every requirement from the above list as Control 5.19 intends, especially when dealing with rigid public sector organisations.

That being said, Control 5.19 clearly states that organisations should use the above guidance when forming relationships with suppliers, and consider non-adherence on a case-by-case basis.

Where full compliance isn’t achievable, Control 5.19 gives organisations leeway by recommending “compensating controls” that achieve adequate levels of risk management, based on an organisation’s unique circumstances.

Changes from ISO 27002:2013

27002:2022-5.19 replaces 27002:2013-5.1.1 (Information security policy for supplier relationships).

27002:2022-5.19 broadly adheres to the same underlying concepts contained in the 2013 control, but does contain several additional guidance areas that are either omitted from 27002:2013-5.1.1, or at the very least not covered in as much detail, including:

• The vetting of suppliers based on their supplier type and risk level.
• The need to ensure the integrity of supplier information in order to secure their own data, and ensure business continuity.
• The various steps required when ending a supplier relationship, including the decommissioning of access rights, IP distribution, contractual agreements etc.

27002:2022-5.19 is also explicit in acknowledging the highly variable nature of supplier relationships (based on type, sector and risk level), and gives organisations a certain degree of leeway when considering the possibility of non-compliance of any given guidance point, based on the nature of the relationship (see ‘Supplementary Guidance’ above).

How ISMS.online Helps

Using ISMS.online you can:

• Quickly implement an Information Security Management System (ISMS).
• Easily manage the documentation of your ISMS.
• Streamline compliance with all relevant standards.
• Manage all aspects of information security, from risk management to security awareness training.
• Effectively communicate throughout your organisation using our built-in communication functionality.

It’s a simple matter of creating a free trial account and following the steps we provide.

Get in touch today to book a demo.