In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.21 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.
I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.
Key Takeaways: ISO 27001 Annex A 5.16 Identity Management
ISO 27001 Annex A 5.21 requires organizations to define and implement processes to manage the information security risks associated with the ICT (Information and Communications Technology) products and services supply chain. This control addresses the “layered” risk of modern computing; your organization relies on a CRM, which relies on a Cloud Host, which relies on specific software libraries (like OpenSSL). This “preventive” control ensures that security requirements are propagated throughout the entire chain, reducing the risk of a supply chain attack.
Core requirements for compliance include:
- Mapping the Chain: You must identify not only your direct vendors (Tier 1) but also understand their critical sub-processors (Tier 2). This is especially vital for Cloud Services.
- Propagated Requirements: Agreements should mandate that your suppliers apply your security requirements to their own sub-contractors and component suppliers.
- Component Traceability: For critical systems, you must be able to trace the origin of ICT components to ensure they come from reputable and vetted sources.
- Software Transparency: Suppliers should provide information on the software components they use (including open-source libraries) and provide assurance that they are free from known vulnerabilities.
- Continuous Monitoring: Organizations must implement validation steps to ensure that suppliers continue to meet agreed-upon security levels throughout the contract lifecycle.
- Succession Planning: You must consider alternate suppliers for critical ICT components to ensure business continuity if a primary vendor fails or becomes insecure.
Audit Focus: Auditors will look for “The Sub-Processor Trail”:
- Direct Risk Assessment: “Show me how you assessed the security of your critical SaaS providers. Did you check if they use sub-processors located in high-risk jurisdictions?”
- Reputable Sourcing: “How do you verify that the hardware or software you purchase comes from an authorized and reputable channel?”
- Vulnerability Assurance: “When a major vulnerability (like Log4j) is announced, how do you verify if your ICT suppliers are affected and what they are doing to patch it?”
Supply Chain Mapping Example (Audit Prep):
| Tier | Relationship | Vetting Responsibility | Example | ISO 27001:2022 Control |
|---|---|---|---|---|
| Tier 1 | Direct Vendor. | YOU check them. | Salesforce (CRM). | Annex A 5.21 / 5.19 |
| Tier 2 | Sub-Processor. | Tier 1 checks them. | AWS (Hosting Salesforce). | Annex A 5.21 |
| Tier 3 | Component / Library. | Tier 2 checks them. | OpenSSL (Library in AWS). | Annex A 5.21 / 8.8 |
| Tier 4 | Infrastructure. | Tier 3 checks them. | Data Center Power Grid. | Annex A 5.21 / 7.1 |
Table of contents
- What is ICT?
- What is ISO 27001 Annex A 5.21?
- Watch the ISO 27001 Annex A 5.21 Tutorial
- ISO 27001 Annex A 5.21 Podcast
- ISO 27001 Annex A 5.21 Implementation Guidance
- How to implement ISO 27001 Annex A 5.21
- Supply Chain Mapping Example
- ISO 27001 Supplier Register Template
- ISO 27001 Supplier Policy Template
- How to comply
- How to pass the ISO 27001 Annex A 5.21 audit
- What an auditor will check
- Top 3 ISO 27001 Annex A 5.21 Mistakes People Make and How to Avoid Them
- Applicability of ISO 27001 Annex A 5.21 across different business models.
- Fast Track ISO 27001 Annex A 5.21 Compliance with the ISO 27001 Toolkit
- ISO 27001 Annex A 5.21 FAQ
- Related ISO 27001 Controls
- Further Reading
- ISO 27001 controls and attribute values
What is ICT?
ICT, or information and communications technology (or technologies), is the infrastructure and components that enable modern computing.
What is ISO 27001 Annex A 5.21?
ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain is an ISO 27001 control that requires an organisation to manage the risks associated the ICT products and services supply chain.
ISO 27001 Annex A 5.21 is managing information security in your IT suppliers and means you need a process to handle information security risks of your third party suppliers, products, systems and services.
ISO 27001 Annex A 5.21 Purpose
The purpose of ISO 27001 Annex A 5.21 is a preventive control that ensures you maintain an agreed level of information security in supplier relationships.
ISO 27001 Annex A 5.21 Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.21 as:
Processes and procedures should be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.
ISO 27001:2022 Annex A 5.21 Managing information security in the ICT supply chain
Watch the ISO 27001 Annex A 5.21 Tutorial
In the video ISO 27001 Managing Information Security In The ICT Supply Chain Explained – ISO27001 Annex A 5.21 I show you how to implement it and how to pass the audit.
ISO 27001 Annex A 5.21 Podcast
In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.21 Managing Information Security In The ICT Supply Chain. The podcast explores what it is, why it is important and the path to compliance.
ISO 27001 Annex A 5.21 Implementation Guidance
We discussed above that ICT means information and communications technology and we would include cloud services in that.
When we implement we are looking to build on existing best practices for information security, project management, quality management and engineering and not to replace those practices.
You are going to have to ensure that:
- you have information security requirements when acquiring products or services
- your suppliers propagate your security requirements through ‘their’ supply chain if they sub contract
- you request, and understand, of product suppliers, what software components they use
- you request and understand product security functions and how to configure it to be secure
- you implement monitoring and validation of security requirements in your suppliers
- you identify and document critical products and services
- critical components and their origin can be traced through the supply chain
- you have assurance products are functioning as expected
- you have assurance products meet required security levels
- you have rules for sharing information including issues and compromises
- you have process for managing component lifecycles, availability and associated security risks
- you have considered alternate suppliers and how to transfer to them if needed
It is always best and goes without saying, or it should, that you will acquire your products and services from reputable sources.
How to implement ISO 27001 Annex A 5.21
Implementing ISO 27001 Annex A 5.21 requires a shift from general procurement to a rigorous, technology-centric governance model. By scrutinising the Information and Communication Technology (ICT) supply chain, organisations can mitigate risks such as hardware tampering, software backdoors, and insecure code updates. This action-orientated guide outlines the technical and procedural steps necessary to secure your technology stack and satisfy lead auditor expectations for the 2022 standard.
1. Formalise the ICT Procurement Security Policy
Establish a topic-specific policy that mandates security requirements for all technology-related acquisitions. This result-focused action prevents the introduction of unvetted hardware or software into the production environment.
- Define mandatory security certifications for ICT vendors, such as ISO 27001, SOC 2, or Common Criteria.
- Specify technical requirements for software development, including the mandatory use of Software Bill of Materials (SBOM).
- Document the authorisation process for all ICT subcontractors (Nth-party risk) to ensure transparency across the supply chain.
2. Provision a Technical Vendor Risk Assessment (VRA) Framework
Deploy a specialised vetting process that focuses on technical integrity rather than just financial stability. This ensures that every component in your ICT stack is verified for authenticity and security before onboarding.
- Implement a technical questionnaire that assesses a supplier’s Secure Development Lifecycle (SDLC) and patch management protocols.
- Verify the provenance of hardware components to mitigate the risk of counterfeit or tampered physical assets.
- Review the supplier’s Rules of Engagement (ROE) for remote maintenance and administrative access.
3. Formalise ICT-Specific Contractual Security Obligations
Embed stringent security requirements into legally binding Service Level Agreements (SLAs) and contracts. This action provides the legal leverage required to enforce compliance throughout the technology lifecycle.
- Include “Right to Audit” clauses that allow for technical security reviews and vulnerability scans of the provider’s infrastructure.
- Mandate immediate incident notification timeframes for any security events affecting the ICT products or services.
- Define data residency requirements and encryption standards for data at rest and in transit within the provider’s systems.
4. Execute Continuous Monitoring of ICT Integrity
Establish a monitoring programme to track the security posture of technology products after they have been integrated. This result-focused step ensures that new vulnerabilities are identified and remediated through the supplier’s update process.
- Monitor the supplier’s security advisories and vulnerability disclosure programme for patches affecting your ICT stack.
- Utilise automated tools to verify the integrity of software updates and digital signatures before deployment.
- Perform periodic configuration audits on cloud services (SaaS/PaaS) to ensure Identity and Access Management (IAM) roles remain aligned with the Principle of Least Privilege.
5. Formalise ICT Exit and Transition Strategies
Develop documented exit plans for critical ICT suppliers to prevent vendor lock-in and ensure the secure return of intellectual property. This action ensures business continuity and data security during the termination of technology services.
- Define technical protocols for the secure extraction and porting of data from the provider’s platform.
- Establish a verified process for the revocation of all supplier-managed IAM roles and Multi-Factor Authentication (MFA) tokens upon contract termination.
- Obtain formal certificates of data destruction for all organisational information held on the supplier’s secondary or backup systems.
Supply Chain Mapping Example
| Tier | Relationship | Who checks them? | Example |
| Tier 1 | Direct Vendor | YOU check them. | Your CRM Provider (e.g., Salesforce). |
| Tier 2 | Sub-Processor | Tier 1 checks them. | AWS (Hosting the CRM). |
| Tier 3 | Component | Tier 2 checks them. | OpenSSL (Library used by AWS). |
ISO 27001 Supplier Register Template
The ultimate ISO 27001 Supplier Register Template.
ISO 27001 Supplier Policy Template
The ultimate ISO 27001 Supplier Register Template.
How to comply
To comply with ISO 27001 Annex A 5.21 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to
- Implement a topic specific policy
- Implement an supplier management process
- Include in your supplier management process supplier acquisition and supplier transfer
- Implement an ISO 27001 supplier register
- Have agreements with all suppliers that cover information security requirements
- Have information security assurances for critical suppliers as a minimum and ideally all relevant suppliers
How to pass the ISO 27001 Annex A 5.21 audit
To pass an audit of ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain you are going to make sure that you have followed the steps above in how to comply.
What an auditor will check
The audit is going to check a number of areas. Lets go through the most common
1. That you have a supplier agreements in place
The auditor is going to check that you have agreements in place with suppliers that cover the information security requirements. It will check that those agreements are in date and cover the products and / or services acquired.
2. That you have an ISO 27001 Supplier Register
You will need an ISO 27001 Supplier Register to record and manage your suppliers. Make sure it is up to date and reflects your reality.
3. Documentation
They are going to look at audit trails and all your documentation and see that is classified and labelled. All the documents that you show them, as a minimum if they are confidential should be labelled as such. Is the document up to date. Has it been reviewed in the last 12 months. Does the version control match.
Top 3 ISO 27001 Annex A 5.21 Mistakes People Make and How to Avoid Them
The top 3 Mistakes People Make For ISO 27001 Annex A 5.21 are
1. You have no contracts or legal terms with a supplier
Make sure that there is a contract, agreement, terms of business or some legal mechanism for engaging with suppliers and you have a copy, it is in date and covers what you are using.
2. You have no assurance they are doing the right thing for information security
Make sure you have done your security assessment and can place your hands on an in date certificate such as an ISO 27001 Certification for assurance they are doing the right thing. It needs to be in date a cover the products and / or services you have acquired and are using form the supplier.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Applicability of ISO 27001 Annex A 5.21 across different business models.
| Business Type | Applicability & Interpretation | Examples of Control |
|---|---|---|
| Small Businesses |
Off-the-Shelf Hardware & SaaS. You don’t need to audit Intel or Microsoft’s code. Focus on buying from reputable sources (e.g., Dell, Apple) rather than grey-market resellers to avoid tampered hardware. |
• Authorized Channels: Policy mandating all laptops/phones be purchased directly from the manufacturer or authorized distributors. |
| Tech Startups |
Software Supply Chain (SBOM). Your biggest risk is “Tier 3” dependencies (e.g., a compromised npm or PyPi package). Auditors expect you to know what libraries are inside your code. |
• SCA Scanning: Using tools like Snyk or GitHub Dependabot to automatically map and monitor your “Software Bill of Materials” (SBOM). |
| AI Companies |
Model & Compute Provenance. Traceability of where your model weights and training data come from. Ensuring your GPU cloud provider isn’t silently offloading jobs to insecure regions. |
• Model Signing: Using cryptographic signatures (e.g., Sigstore) to verify that the AI models deployed in production haven’t been tampered with since training. |
Fast Track ISO 27001 Annex A 5.21 Compliance with the ISO 27001 Toolkit
For ISO 27001 Annex A 5.21 (Managing information security in the ICT supply chain), the requirement is to manage the risks associated with your ICT products and services supply chain. This means ensuring that your security requirements are propagated through your suppliers to their subcontractors (the “supply chain tiers”) and that critical components can be traced and verified.
| Compliance Factor | SaaS Compliance Platforms | High Table ISO 27001 Toolkit | Audit Evidence Example |
|---|---|---|---|
| Strategy Ownership | Rents access to your risk strategy; if you cancel the subscription, your documented supply chain tiers and vendor configurations vanish. | Permanent Assets: Fully editable Word/Excel Third-Party Policies and Supplier Registers that you own forever. | A localized “ICT Supply Chain Register” identifying Tier 1 direct vendors and their critical sub-processors. |
| Governance Utility | Attempts to “automate” mapping via dashboards that cannot evaluate security functions or identify risky open-source libraries. | Governance-First: Formalizes your existing technical knowledge (e.g., AWS/Salesforce stack) into an auditor-ready framework. | A “Supply Chain Mapping Template” proving you have identified critical components and traced their origin. |
| Cost Efficiency | Charges a “Vendor Tier Tax” based on the depth of mapping or number of sub-processors monitored, creating perpetual overhead. | One-Off Fee: A single payment covers your supply chain governance for 3 tiers or 30. | Allocating budget to security penetration testing or better-vetted products rather than monthly dashboard fees. |
| Strategic Freedom | Mandates rigid reporting formats that often fail to align with agile development models or cloud-native stacks. | 100% Agnostic: Procedures adapt to any environment—high-end traceability tools or simple risk-managed questionnaires. | The ability to evolve your ICT procurement strategy and sub-processor list without reconfiguring a rigid SaaS module. |
Summary: For Annex A 5.21, the auditor wants to see that you have identified critical products and services and have a formal process for managing risks through the supply chain. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.
ISO 27001 Annex A 5.21 FAQ
What is ISO 27001 Annex A 5.21?
ISO 27001 Annex A 5.21 is an information security control that requires organisations to define and implement processes for managing security risks associated with the Information and Communication Technology (ICT) supply chain.
- Focuses on the technical complexities of hardware, software, and cloud services.
- Requires transparency across the entire supply chain, including subcontractors.
- Mandates that security requirements are embedded into procurement and service agreements.
- Aims to prevent “cascading” vulnerabilities from third-party technology providers.
How does Annex A 5.21 differ from general supplier management?
The primary difference is that Annex A 5.21 specifically targets technology-based risks within the ICT stack, whereas general supplier management (5.19) covers all types of vendors.
- Technical Depth: 5.21 looks at software code integrity and hardware authenticity.
- Nth-Party Risk: It requires your direct suppliers to manage their own technology subcontractors.
- Specialised Vetting: Involves checking for backdoors, malware in updates, and hardware tampering.
What are the core requirements for ICT supply chain security?
Compliance with Annex A 5.21 requires a formalised approach to identifying critical ICT suppliers and enforcing technical security standards through legal contracts.
- Risk Assessment: Perform deep-dive vetting of technology providers before onboarding.
- Contractual Clauses: Include “Right to Audit” and mandatory incident reporting requirements.
- Integrity Checks: Verify the authenticity of ICT products to prevent counterfeit components.
- Change Management: Review how suppliers manage updates and patches to their technology.
Does Annex A 5.21 require a Software Bill of Materials (SBOM)?
While the standard does not explicitly name an SBOM, it strongly implies the need for visibility into software components to manage vulnerabilities effectively.
- Provides a list of all open-source and third-party components within a product.
- Allows organisations to react quickly when a specific library (e.g. Log4j) is compromised.
- Supports the requirement for monitoring the security of ICT products over time.
How do you manage risks from cloud and SaaS providers under 5.21?
Managing cloud-based ICT risks requires defining clear shared responsibility models and verifying the provider’s independent security certifications.
- Review SOC 2 Type II or ISO 27001 certificates of the cloud host.
- Ensure data residency requirements are documented and legally binding.
- Assess the provider’s resilience and exit strategy to prevent vendor lock-in risks.
What evidence do auditors look for regarding Annex A 5.21?
Auditors expect to see a documented ICT supply chain risk register and evidence that security requirements were included in supplier selection processes.
- Vendor Risk Assessments: Completed security questionnaires for technology partners.
- Procurement Logs: Proof that security was a weighting factor in the selection process.
- Service Level Agreements (SLAs): Technical requirements for uptime and incident response.
- Audit Reports: Records of reviews conducted on high-risk ICT suppliers.
Related ISO 27001 Controls
ISO 27001 Annex A 5.30 ICT Readiness For Business Continuity
ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements
Further Reading
The complete guide to ISO/IEC 27002:2022
ISO 27001 controls and attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Identify | Supplier relationships security | Protection |
| Integrity | Governance and ecosystem | |||
| Availability |
