How to Implement ISO 27001 Annex A 5.19 Information Security in Supplier Relationships

The ultimate how to implement guide to ISO 27001 Annex A 5.19 Information Security in Supplier Relationships.

1. Formalise the Supplier Security Policy

Control Requirement: A policy must be established to mitigate risks associated with supplier access to the organisation’s assets.

Required Implementation Step: Draft a bespoke Supplier Security Policy that defines minimum technical standards for any third party handling your data. Do not use a generic template; specify encryption requirements, mandatory MFA, and specific notification timeframes for security breaches that align with your internal RTO and RPO.

Minimum Requirement: A board-approved policy document that is referenced in every new supplier contract.

2. Categorise and Risk-Assess the Supplier Base

Control Requirement: All suppliers must be identified and categorised based on the risk they pose to information security.

Required Implementation Step: Build a manual Supplier Register in a controlled document. Categorise suppliers as ‘Critical’, ‘High’, or ‘Standard’ based on their level of access to your production environment or PII, and document the specific risks (e.g., data transit, geographic location) identified for each.

Minimum Requirement: A complete register of all third-party vendors with a documented risk score for each entry.

3. Conduct Manual Technical Due Diligence

Control Requirement: Information security requirements must be agreed upon with the supplier before granting access.

Required Implementation Step: Move beyond automated questionnaires. Schedule a technical call with the supplier’s Lead Engineer to verify their actual implementation of controls, such as their patch management schedule and log retention periods, rather than accepting a ‘Yes’ on a web form.

Minimum Requirement: Records of a technical interview or a signed, detailed security questionnaire verified by your IT lead.

4. Embed Security Clauses into Contracts

Control Requirement: Agreements with suppliers must include requirements to address information security risks.

Required Implementation Step: Open your Master Service Agreement (MSA) and manually insert specific security clauses. These must include the ‘Right to Audit’, mandatory breach notification within a set number of hours, and the requirement for the supplier to cascade these security obligations to their own subcontractors (N-th party risk).

Minimum Requirement: Signed contracts containing specific, non-generic security and data protection appendices.

5. Enforce the Right to Audit

Control Requirement: The organisation must be able to audit the supplier’s security controls as agreed in the contract.

Required Implementation Step: Exercise your contractual right to audit by requesting specific evidence of control effectiveness, such as redacted penetration test summaries or evidence of their last disaster recovery drill. If the supplier is high-risk, perform a manual site visit to inspect their physical security and server room access controls.

Minimum Requirement: An annual audit report or evidence of a formalised ‘Evidence Request’ sent to and fulfilled by the supplier.

6. Manage Changes to Supplier Services

Control Requirement: Changes to the provision of services by suppliers must be managed, taking account of the criticality of business information.

Required Implementation Step: Implement a manual change control process for suppliers. Whenever a supplier changes their hosting provider, API version, or key personnel, you must perform a mini-risk assessment to ensure the security posture has not been degraded by the update.

Minimum Requirement: Change logs showing that supplier-side updates were reviewed and authorised before implementation.

7. Establish Secure Remote Access Protocols

Control Requirement: Supplier access to internal systems must be controlled and monitored.

Required Implementation Step: Do not allow persistent VPN tunnels for suppliers. Configure ‘Just-In-Time’ (JIT) access where account credentials are enabled only for a specific window, and ensure all supplier activity is logged in a separate, immutable audit trail that is reviewed weekly.

Minimum Requirement: Firewall or VPN logs showing that supplier access is time-bound and restricted to specific IP addresses.

8. Monitor and Review Supplier Service Delivery

Control Requirement: The organisation must regularly monitor, review, and audit supplier service delivery.

Required Implementation Step: Hold quarterly service review meetings with critical suppliers. Manually review their performance against the security SLAs defined in the contract, and document any ‘near misses’ or minor security exceptions that occurred during the period.

Minimum Requirement: Minutes from quarterly meetings showing security performance was an explicit agenda item.

9. Plan for Secure Decommissioning and Exit

Control Requirement: Agreements must include requirements for the return or destruction of information at the end of the contract.

Required Implementation Step: Create a manual ‘Supplier Exit Checklist’. When a contract ends, you must obtain a signed ‘Certificate of Data Destruction’ from the supplier and manually revoke all digital and physical access credentials immediately.

Minimum Requirement: A completed exit checklist and signed destruction certificate for the most recently terminated supplier.

10. Address N-th Party (Sub-supplier) Risk

Control Requirement: Suppliers must be required to manage security risks across their own supply chain.

Required Implementation Step: Request a list of all sub-processors used by your primary suppliers. Manually verify where your data is actually stored (down to the data centre level) and ensure your primary supplier has signed security agreements with those sub-processors that are at least as stringent as your own.

Minimum Requirement: A documented map of sub-processors for all ‘Critical’ and ‘High-risk’ suppliers.

About the author