How to Implement ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements

The ultimate how to implement guide to ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements.

1. Conduct a Manual Supplier Inventory Audit

Control Requirement: Maintain a comprehensive list of all suppliers with access to organisational information assets.

Required Implementation Step: Disregard automated ‘discovery’ tools. Manually review the last 12 months of accounts payable records and bank statements to identify every vendor, freelancer, and consultant who has been paid for services. Cross-reference this with a physical list of active system accounts.

Minimum Requirement: A spreadsheet or local document listing supplier name, service provided, and the specific classification of data they access.

2. Perform Individual Supplier Risk Categorisation

Control Requirement: Identify and document the specific security risks associated with each supplier relationship.

Required Implementation Step: Sit down with the relevant internal stakeholder for each supplier. Document the worst-case scenario if that supplier was breached. Assign a risk level (Low, Medium, High) based on data volume and sensitivity, rather than relying on a generic ‘Security Score’ from a SaaS tool.

Minimum Requirement: A signed-off risk assessment for every ‘High’ and ‘Medium’ risk supplier.

3. Draft Customised Security Clauses for Master Service Agreements (MSA)

Control Requirement: Agreements with suppliers must address security requirements for accessing, processing, and storing data.

Required Implementation Step: Direct your legal counsel to insert specific, non-negotiable security requirements into your MSAs. This must include physical security, encryption standards for data at rest, and background checks for supplier personnel.

Minimum Requirement: Evidence of bespoke security appendices in at least three active supplier contracts.

4. Formulate Explicit Right-to-Audit Clauses

Control Requirement: The organisation must have the right to monitor and review supplier performance against security requirements.

Required Implementation Step: Manually edit contracts to ensure you have the ‘Right to Audit’. This should include the right to conduct on-site physical inspections of their server rooms or offices, not just the right to view a SOC2 report.

Minimum Requirement: Contractual language that allows for a 48-hour notice period for an on-site security review.

5. Define Hard Deadlines for Incident Notification

Control Requirement: Suppliers must notify the organisation of any security incidents involving their data.

Required Implementation Step: Specify a precise timeframe (e.g., “within 24 hours of discovery”) in the contract. Require the supplier to provide a manual phone call to a designated internal contact, rather than just an automated email to a generic ‘support@’ alias.

Minimum Requirement: A defined ‘Incident Communication Plan’ attached as an exhibit to the supplier agreement.

6. Establish Data Return and Destruction Protocols

Control Requirement: Agreements must address the return or destruction of information at the end of the contract.

Required Implementation Step: Do not trust a “Delete All” button in a portal. Require a signed ‘Certificate of Destruction’ on the supplier’s company letterhead. Define exactly how data is to be handed back (e.g., encrypted physical drive or secure transfer).

Minimum Requirement: An ‘Offboarding Checklist’ for every terminated supplier, verified by the IT Manager.

7. Enforce Supply Chain Transparency (Fourth-Party Risk)

Control Requirement: Suppliers must ensure their sub-contractors meet the same security standards agreed upon with you.

Required Implementation Step: Require the supplier to provide a list of their sub-processors. Manually verify that their contracts with these sub-processors mirror the security obligations they have committed to with your organisation.

Minimum Requirement: A contractual clause prohibiting the use of sub-contractors for data processing without prior written consent.

8. Implement Physical Credential Revocation Procedures

Control Requirement: Supplier access to assets must be controlled and monitored.

Required Implementation Step: Create a manual log of all supplier-issued hardware tokens, VPN accounts, and physical keys. Upon completion of a project, a staff member must physically verify the return of equipment and the manual deletion of accounts in Active Directory.

Minimum Requirement: A signed ‘Access Revocation’ log entry for every departed contractor or supplier staff member.

9. Verify Personnel Screening Requirements

Control Requirement: Suppliers must screen their employees according to the risk level of the data they handle.

Required Implementation Step: Request anonymised evidence of background checks from your suppliers. Do not accept a verbal “we do it.” Manually check that the depth of the background check (e.g., DBS check in the UK) matches the sensitivity of the data they access.

Minimum Requirement: Redacted proof of background checks for any supplier personnel with ‘Admin’ level access to your systems.

10. Maintain a Local Physical Evidence File

Control Requirement: Maintain evidence of compliance for supplier security management.

Required Implementation Step: Download all signed contracts, addendums, and certificates from cloud signing platforms. Store them on a local, encrypted file server or in a physical filing cabinet. Reliance on a GRC platform to hold your evidence is a single point of failure that auditors hate.

Minimum Requirement: A locally hosted folder containing PDF versions of all signed security appendices and supplier risk assessments.

About the author