Information security in supplier relationships

What the requirement asks

The organization is to define and run processes and procedures that manage the information security risks arising from using suppliers' products or services. Purpose: keep security in dealings with suppliers at the level both sides agreed. Guidance: set a topic-specific supplier relationship policy and share it with relevant parties. Processes, including those applying to cloud service providers and those the organization requires suppliers to follow when use of a product or service starts or ends, should cover: identifying and recording the kinds of supplier (ICT services, logistics, utilities, financial services, infrastructure components) that could affect confidentiality, integrity or availability; deciding how suppliers are evaluated and chosen according to sensitivity, using market analysis, references, document review, on-site assessment or certification; choosing and reviewing products and services with adequate controls, especially the accuracy and completeness of controls protecting that the supplier's own information and processing stay intact; defining which information, ICT services and physical infrastructure suppliers may access, monitor, control or use; defining the supplier-provided infrastructure components and services that could affect the organization; assessing and managing risks from suppliers' use of the organization's assets (including malicious supplier staff) and from faulty or vulnerable products, components or services; monitoring compliance per supplier and access type, which can involve independent reviews and validating products; dealing with supplier non-compliance however it is found; handling supplier-related incidents and contingencies with each side's responsibilities; resilience, recovery and contingency so the supplier's information and processing stay available; awareness and training for staff who deal with supplier personnel; managing transfers of information and assets securely during transition; secure termination covering removal of access, information handling, ownership of intellectual property created, portability on change of supplier or insourcing, record keeping, the return of assets, secure disposal and lasting confidentiality; and the personnel and physical security expected of supplier staff and sites. Plans for continuing if a supplier can no longer deliver, for example by pre-identifying or routinely using alternatives, should be considered. Other information: where requirements cannot be imposed, use this guidance in choosing the supplier and add compensating controls based on risk; NDAs or cryptography can protect confidentiality, cross-border data access raises privacy risk, legal responsibility for the information stays with the organization, and vulnerable supplier components can harm the organization or others; ISO/IEC 27036-2 has more detail. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Supplier relationships start with a decision about what the supplier can see and do. The guidance asks for the supplier inventory, the risk tier, the owner and the security requirements that follow.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific supplier relationship policy and its communication record and one live sample together.

Evidence an assessor asks for

• Supplier risk managementThe topic-specific supplier relationship policy and its communication record
• Supplier risk managementA supplier inventory categorized by type and by the information, services and infrastructure each can access
• Supplier risk managementSupplier due diligence and selection records such as questionnaires, certifications, references and on-site assessment reports, scaled to sensitivity
• Supplier risk managementSupplier risk assessments covering misuse of organizational assets and product or component vulnerabilities
• Supplier risk managementSupplier monitoring and non-compliance records with remediation actions
• Supplier risk managementExit and contingency plans for critical suppliers covering access removal, data return or destruction, portability, intellectual property and alternative supply

The question an assessor will ask

An assessor will ask for the topic-specific supplier relationship policy and its communication record, then trace it to the system it protects. For A.5.19 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Suppliers are onboarded by procurement without any security assessment
• Cloud service providers are not treated as suppliers under the policy
• No exit plan exists for critical suppliers, so access and data linger after termination
• Monitoring stops after onboarding and relies solely on an annual certificate

Before the next audit

Before the next audit, check one live sample for this gap: suppliers are onboarded by procurement without any security assessment.