ISO 27001:2022 Annex A 5.21 Managing information security in the ICT supply chain

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.21 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 5.16 Identity Management

ISO 27001 Annex A 5.21 requires organizations to define and implement processes to manage the information security risks associated with the ICT (Information and Communications Technology) products and services supply chain. This control addresses the “layered” risk of modern computing; your organization relies on a CRM, which relies on a Cloud Host, which relies on specific software libraries (like OpenSSL). This “preventive” control ensures that security requirements are propagated throughout the entire chain, reducing the risk of a supply chain attack.

Core requirements for compliance include:

• Mapping the Chain: You must identify not only your direct vendors (Tier 1) but also understand their critical sub-processors (Tier 2). This is especially vital for Cloud Services.
• Propagated Requirements: Agreements should mandate that your suppliers apply your security requirements to their own sub-contractors and component suppliers.
• Component Traceability: For critical systems, you must be able to trace the origin of ICT components to ensure they come from reputable and vetted sources.
• Software Transparency: Suppliers should provide information on the software components they use (including open-source libraries) and provide assurance that they are free from known vulnerabilities.
• Continuous Monitoring: Organizations must implement validation steps to ensure that suppliers continue to meet agreed-upon security levels throughout the contract lifecycle.
• Succession Planning: You must consider alternate suppliers for critical ICT components to ensure business continuity if a primary vendor fails or becomes insecure.

Audit Focus: Auditors will look for “The Sub-Processor Trail”:

1. Direct Risk Assessment: “Show me how you assessed the security of your critical SaaS providers. Did you check if they use sub-processors located in high-risk jurisdictions?”
2. Reputable Sourcing: “How do you verify that the hardware or software you purchase comes from an authorized and reputable channel?”
3. Vulnerability Assurance: “When a major vulnerability (like Log4j) is announced, how do you verify if your ICT suppliers are affected and what they are doing to patch it?”

Supply Chain Mapping Example (Audit Prep):

Tier	Relationship	Vetting Responsibility	Example
Tier 1	Direct Vendor.	YOU check them.	Salesforce (CRM).
Tier 2	Sub-Processor.	Tier 1 checks them.	AWS (Hosting Salesforce).
Tier 3	Component / Library.	Tier 2 checks them.	OpenSSL (Library in AWS).
Tier 4	Infrastructure.	Tier 3 checks them.	Data Center Power Grid.

What is ICT?

ICT, or information and communications technology (or technologies), is the infrastructure and components that enable modern computing.

What is ISO 27001 Annex A 5.21?

ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain is an ISO 27001 control that requires an organisation to manage the risks associated the ICT products and services supply chain.

ISO 27001 Annex A 5.21 is managing information security in your IT suppliers and means you need a process to handle information security risks of your third party suppliers, products, systems and services.

ISO 27001 Annex A 5.21 Purpose

The purpose of ISO 27001 Annex A 5.21 is a preventive control that ensures you maintain an agreed level of information security in supplier relationships.

ISO 27001 Annex A 5.21 Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.21 as:

Processes and procedures should be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.

ISO 27001:2022 Annex A 5.21 Managing information security in the ICT supply chain

Watch the ISO 27001 Annex A 5.21 Tutorial

In the video ISO 27001 Managing Information Security In The ICT Supply Chain Explained – ISO27001 Annex A 5.21 I show you how to implement it and how to pass the audit.

ISO 27001 Annex A 5.21 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.21 Managing Information Security In The ICT Supply Chain. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 5.21

We discussed above that ICT means information and communications technology and we would include cloud services in that.

When we implement we are looking to build on existing best practices for information security, project management, quality management and engineering and not to replace those practices.

You are going to have to ensure that:

• you have information security requirements when acquiring products or services
• your suppliers propagate your security requirements through ‘their’ supply chain if they sub contract
• you request, and understand, of product suppliers, what software components they use
• you request and understand product security functions and how to configure it to be secure
• you implement monitoring and validation of security requirements in your suppliers
• you identify and document critical products and services
• critical components and their origin can be traced through the supply chain
• you have assurance products are functioning as expected
• you have assurance products meet required security levels
• you have rules for sharing information including issues and compromises
• you have process for managing component lifecycles, availability and associated security risks
• you have considered alternate suppliers and how to transfer to them if needed

It is always best and goes without saying, or it should, that you will acquire your products and services from reputable sources.

Supply Chain Mapping Example

Tier	Relationship	Who checks them?	Example
Tier 1	Direct Vendor	YOU check them.	Your CRM Provider (e.g., Salesforce).
Tier 2	Sub-Processor	Tier 1 checks them.	AWS (Hosting the CRM).
Tier 3	Component	Tier 2 checks them.	OpenSSL (Library used by AWS).

ISO 27001 Supplier Register Template

The ultimate ISO 27001 Supplier Register Template.

ISO 27001 Supplier Policy Template

The ultimate ISO 27001 Supplier Register Template.

How to comply

To comply with ISO 27001 Annex A 5.21 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

• Implement a topic specific policy
• Implement an supplier management process
• Include in your supplier management process supplier acquisition and supplier transfer
• Implement an ISO 27001 supplier register
• Have agreements with all suppliers that cover information security requirements
• Have information security assurances for critical suppliers as a minimum and ideally all relevant suppliers

How to pass the ISO 27001 Annex A 5.21 audit

To pass an audit of ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain you are going to make sure that you have followed the steps above in how to comply.

What an auditor will check

The audit is going to check a number of areas. Lets go through the most common

1. That you have a supplier agreements in place

The auditor is going to check that you have agreements in place with suppliers that cover the information security requirements. It will check that those agreements are in date and cover the products and / or services acquired.

2. That you have an ISO 27001 Supplier Register

You will need an ISO 27001 Supplier Register to  record and manage your suppliers. Make sure it is up to date and reflects your reality.

3. Documentation

They are going to look at audit trails and all your documentation and see that is classified and labelled. All the documents that you show them, as a minimum if they are confidential should be labelled as such. Is the document up to date. Has it been reviewed in the last 12 months. Does the version control match.

Top 3 ISO 27001 Annex A 5.21 Mistakes People Make and How to Avoid Them

The top 3 Mistakes People Make For ISO 27001 Annex A 5.21 are

1. You have no contracts or legal terms with a supplier

Make sure that there is a contract, agreement, terms of business or some legal mechanism for engaging with suppliers and you have a copy, it is in date and covers what you are using.

2. You have no assurance they are doing the right thing for information security

Make sure you have done your security assessment and can place your hands on an in date certificate such as an ISO 27001 Certification for assurance they are doing the right thing. It needs to be in date a cover the products and / or services you have acquired and are using form the supplier.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Fast Track ISO 27001 Annex A 5.x Compliance with the ISO 27001 Toolkit

---

Own Your ISMS, Don’t Rent It

Do it Yourself ISO 27001 with the Ultimate ISO 27001 Toolkit

---

For ISO 27001 Annex A 5.21 (Managing information security in the ICT supply chain), the requirement is to manage the risks associated with your ICT products and services supply chain. This means ensuring that your security requirements are propagated through your suppliers to their subcontractors (the “supply chain tiers”) and that critical components can be traced and verified.

While SaaS compliance platforms often try to sell you “automated supply chain mapping” or complex “sub-processor dashboards,” they cannot actually request and understand a product’s security functions or decide which “Tier 3” open-source library represents a risk to your specific architecture, those are human governance and engineering tasks. The High Table ISO 27001 Toolkit is the logical choice because it provides the supply chain framework you need to manage ICT risks effectively without a recurring subscription fee.

1. Ownership: You Own Your Supply Chain Framework Forever

SaaS platforms act as a middleman for your compliance evidence. If you map your supply chain tiers and store your vendor security configurations inside their proprietary system, you are essentially renting your own technical risk strategy.

• The Toolkit Advantage: You receive the Third-Party Supplier Policy and Supplier Register in fully editable Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as your specific requirements for “Tier 1” direct vendors), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World ICT

Annex A 5.21 is about knowing who your vendors rely on. You don’t need a complex new software interface to manage what a simple mapping of your CRM and its cloud hosting provider already does perfectly.

• The Toolkit Advantage: Your technical team already knows they use AWS and Salesforce. What they need is the governance layer to prove to an auditor that they have identified critical products, traced their origin, and have assurance that they function as expected. The Toolkit provides pre-written procedures and “Supply Chain Mapping Examples” that formalize your existing technical knowledge into an auditor-ready framework, without forcing your team to learn a new software platform just to log a sub-processor.

3. Cost: A One-Off Fee vs. The “Vendor Tier” Tax

Many compliance SaaS platforms charge based on the “depth” of your supply chain mapping or the number of “sub-processors” you monitor. For a control that requires you to trace components through multiple tiers, these monthly costs can scale aggressively.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you map 3 tiers or 30, the cost of your ICT Supply Chain Documentation remains the same. You save your budget for actual security testing or choosing better-vetted products rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your ICT Strategy

SaaS tools often mandate specific ways to report on and monitor the ICT supply chain. If their system doesn’t match your agile development model or unique cloud-native stack, the tool becomes a bottleneck to efficiency.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Supply Chain Procedures to match exactly how you operate, whether you use high-end traceability tools or simple, risk-managed supplier questionnaires. You maintain total freedom to evolve your ICT strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 5.21, the auditor wants to see that you have identified critical products and services and have a formal process for managing risks through the supply chain. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Annex A 5.21 FAQ

Related ISO 27001 Controls

ISO 27001 Annex A 5.30 ICT Readiness For Business Continuity

ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements

Further Reading

The complete guide to ISO/IEC 27002:2022

ISO 27001 controls and attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Identify	Supplier relationships security	Protection
	Integrity			Governance and ecosystem
	Availability

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.