Addressing information security within supplier agreements

What the requirement asks

The information security requirements that matter for each supplier are to be set and agreed with that supplier, depending on the type of relationship. Purpose: make the agreed security level in each supplier relationship enforceable. Guidance: documented agreements should leave both parties clear about their security obligations. Terms to consider include: what information the supplier will receive or reach and by what means; its classification under the organization's scheme (5.10, 5.12, 5.13) and how that maps to the supplier's scheme; legal, regulatory and contractual obligations such as data protection, PII handling, intellectual property and copyright, and how compliance will be ensured; each party's duty to operate agreed controls (access control, performance review, monitoring, reporting, auditing) and the supplier's duty to meet the organization's requirements; acceptable and unacceptable use; how supplier staff are authorized and de-authorized, for instance an explicit list of named people; requirements for the supplier's ICT infrastructure with minimum requirements per information and access type; indemnities and remedies for failure; incident procedures, especially notification and joint remediation; training and awareness for specific procedures; subcontracting provisions such as flowing down obligations, a list of sub-suppliers and notice before changes; contacts including a security contact; lawful screening of supplier staff with responsibilities and what happens if screening is incomplete or raises concern; third-party attestations and independent reports on control effectiveness; a right to audit; periodic control effectiveness reports with timely correction of issues; defect and dispute resolution; backups matching the organization's needs for frequency, type and location; an alternate recovery site not exposed to the same threats, plus fallback controls; change management with advance notice and the option to refuse changes; physical security matching classification; protection in physical and logical transfer; termination terms on records, asset return, secure disposal and continuing confidentiality; secure destruction of the organization's information once no longer needed; and handover support at contract end to a new supplier or back in-house. A register of contracts, memoranda and information-sharing arrangements with outside parties (contracts, memoranda, information-sharing agreements) tracks where information goes, and agreements are regularly reviewed, validated and updated. Other information: agreements vary widely by organization and supplier type; ISO/IEC 27036 covers supplier agreements and ISO/IEC 19086 cloud service agreements. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Supplier agreements carry the requirements. The guidance asks for the security schedule, the reporting duty, the audit or assurance right, the incident route and the exit terms.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep supplier agreements containing security clauses proportionate to the relationship, such as classification labels, agreed controls, incident notification, subcontracting, right to audit and termination terms and one live sample together.

Evidence an assessor asks for

• Supplier contractsSupplier agreements containing security clauses proportionate to the relationship, such as classification labels, agreed controls, incident notification, subcontracting, right to audit and termination terms
• Supplier contractsA register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
• Supplier contractsMinimum security requirement templates per information type and access type used as the basis for individual contracts
• Supplier contractsSupplier-provided attestations or independent control effectiveness reports and records of issues raised and corrected
• Supplier contractsLists of supplier personnel authorized to use organizational information and assets
• Supplier contractsContract clauses and evidence covering secure destruction of information and handover support at contract end

The question an assessor will ask

An assessor will ask for supplier agreements containing security clauses proportionate to the relationship, such as classification labels, agreed controls, incident notification, subcontracting, right to audit and termination terms, then trace it to the system it protects. For A.5.20 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Standard procurement terms are used with no security schedule for high-risk suppliers
• The right to audit or to receive assurance reports is missing from critical contracts
• No register of agreements exists, so the organization cannot say which parties hold its information
• Subcontracting clauses do not flow security obligations down to sub-suppliers

Before the next audit

Before the next audit, check one live sample for this gap: standard procurement terms are used with no security schedule for high-risk suppliers.