In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.22 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.
I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.
Key Takeaways: ISO 27001 Annex A 5.22 Monitoring, Review, and Change Management of Supplier Services
ISO 27001 Annex A 5.22 requires organizations to regularly monitor, review, and evaluate supplier service delivery. This control ensures that the information security practices agreed upon in your contracts (Annex A 5.20) are actually being followed in reality. In a modern “SaaS-first” business, suppliers are your biggest risk; this “preventive” control ensures that you maintain oversight of their performance, respond to their security incidents, and manage any changes they make to their services without compromising your own security posture.
Core requirements for compliance include:
- Continuous Performance Monitoring: You must track supplier performance against agreed service levels (SLAs). This is typically done through monthly or quarterly service reports and dashboards.
- Regular Security Reviews: Critical suppliers should be evaluated at least annually. This involves verifying they still hold valid certifications (like ISO 27001 or SOC 2) and haven’t experienced major security regressions.
- Supplier Change Management: You must monitor and respond to changes made by the supplier, such as updates to their software, changes in their sub-processors, or shifts in their data hosting locations.
- Incident & Problem Management: Organizations must have a structured way to respond when a supplier has a security breach or a service outage, ensuring that the impact on your business is minimized.
- Audit Rights Execution: If your contract includes a “Right to Audit,” you should periodically exercise it, either through a direct audit or by reviewing the supplier’s third-party assurance reports.
- Centralized Supplier Register: All monitoring activities and review outcomes should be recorded in an up-to-date Supplier Register.
Audit Focus: Auditors will look for “The Oversight Trail”:
- Evidence of Review: “Show me the minutes from your last quarterly review meeting with your critical hosting provider. What security issues were discussed?”
- Assurance Verification: “Show me the current ISO 27001 certificate for your payroll provider. When does it expire, and who is responsible for checking it?”
- Change Impact: “When your CRM provider moved their data storage from the US to the EU, how did you assess the impact on your data privacy compliance?”
Monitoring Metrics Matrix (Audit Prep):
| Metric Type | Critical Focus | Review Frequency | Target “Good” Score | ISO 27001:2022 Control |
|---|---|---|---|---|
| Availability | System Uptime (SLA). | Monthly. | > 99.9% | Annex A 5.22 / 8.14 |
| Responsiveness | Incident Ticket Reply Time. | Quarterly. | < 4 Hours. | Annex A 5.22 / 5.26 |
| Assurance | Valid ISO 27001 / SOC 2 Cert. | Annually. | Valid & In-Scope. | Annex A 5.22 / 5.23 |
| Security | Number of Data Breaches. | Ad-hoc / Continuous. | 0 Reported. | Annex A 5.22 / 5.24 |
Table of contents
- What is ISO 27001 Annex A 5.22?
- Watch the ISO 27001 Annex A 5.22 Tutorial
- ISO 27001 Annex A 5.22 Podcast
- ISO 27001 Annex A 5.22 Implementation Guidance
- How to implement ISO 27001 Annex A 5.22
- Monitoring Metrics Matrix
- ISO 27001 Supplier Register Template
- ISO 27001 Supplier Policy Template
- How to comply
- How to pass an ISO 27001 Annex A 5.22 audit
- What the auditor will check
- Top 3 ISO 27001 Annex A 5.22 Mistakes People Make and How to Avoid Them
- Applicability of ISO 27001 Annex A 5.22 across different business models.
- Fast Track ISO 27001 Annex A 5.22 Compliance with the ISO 27001 Toolkit
- ISO 27001 Annex A 5.22 FAQ
- Related ISO 27001 Controls
- Further Reading
- ISO 27001 controls and attribute values
What is ISO 27001 Annex A 5.22?
ISO 27001 Annex A 5.22 is ensuring the confidentiality, integrity and availability of your suppliers, their products and their services through monitoring and review.
ISO 27001 Annex A 5.22 Monitor, review and change management of supplier services is an ISO 27001 control that requires an organisation to maintain an agreed level of service and information security in line with legal agreements.
ISO 27001 Annex A 5.22 Purpose
The purpose of ISO 27001 Annex A 5.22 is a preventive control that ensures you maintain an agreed level of information security and service delivery in line with supplier agreements.
ISO 27001 Annex A 5.22 Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.22 as:
The organisation should regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.
ISO 27001:2022 Annex A 5.22 Monitor, review and change management of supplier services
Watch the ISO 27001 Annex A 5.22 Tutorial
In the video ISO 27001 Monitoring Review Change Management of Supplier Services Explained – ISO27001 Annex A 5.22 I show you how to implement it and how to pass the audit.
ISO 27001 Annex A 5.22 Podcast
In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.22 Monitor, Review And Change Management Of Supplier Services. The podcast explores what it is, why it is important and the path to compliance.
ISO 27001 Annex A 5.22 Implementation Guidance
As with all the clauses that relate to supplier management we are looking to assign the responsibility to a person or a team with the skills and resources to be able to track that requirements are being met and where not, they are being addressed.
In basic terms it is about making sure that the terms and conditions in legal agreements that relate to information security are being met. It is about managing issues, problems and incidents as the occur and if changes are needed to suppliers that those changes do not adversely impact the business.
You are going to:
- Those service performance levels are going to be monitored, most likely via reports or metrics or dashboards.
- Check and respond to changes made by suppliers such as updates, changes to process, changes to controls
- Where supplier services change to monitor and respond to those
- Keep your eye on the terms and conditions of the agreements and that they are followed
- Ensure those pesky suppliers are evaluated and maintain adequate security
It isn’t really that hard although you can over complicate it very easily. Have agreements in place, make sure they are followed, check them and respond when things go wrong.
We are not teaching people how to do supplier management or change it. What is here is common sense.
How to implement ISO 27001 Annex A 5.22
Implementing ISO 27001 Annex A 5.22 requires a transition from static contract management to active operational oversight. Organisations must establish a continuous feedback loop that monitors supplier performance, reviews security compliance, and manages technical changes to ensure third-party risks remain within acceptable thresholds. Following these action-orientated steps ensures your supplier management framework is robust, transparent, and fully aligned with the 2022 standard requirements.
1. Formalise the Supplier Monitoring Framework
Establish a documented process for tracking supplier performance against agreed security requirements and service level agreements (SLAs). This action ensures that deviations in service delivery are identified and remediated before they impact organisational security.
- Define specific Key Performance Indicators (KPIs) for security, such as incident response times and system uptime.
- Review periodic service reports provided by the supplier to verify compliance with contractual obligations.
- Monitor the supplier’s ongoing financial stability and ownership status to identify potential upstream risks.
2. Execute Periodic Security and Audit Reviews
Conduct regular assessments of the supplier’s security posture through the review of independent audit evidence and onsite inspections where necessary. This results in objective verification that the supplier’s internal controls remain effective.
- Request and analyse annual SOC 2 Type II reports or ISO 27001 surveillance certificates.
- Verify that the scope of the supplier’s certifications covers the specific services and data locations used by your organisation.
- Implement a risk-based review schedule, increasing frequency for suppliers with “High” impact scores or those handling Personal Identifiable Information (PII).
3. Formalise a Supplier Change Management Procedure
Apply a structured change control process to any alterations in supplier services, technology stacks, or contractual terms. This action prevents the introduction of new vulnerabilities during service transitions or updates.
- Perform a security impact assessment for any proposed technical changes to the supplier’s delivery environment.
- Update internal risk assessments and Information Security Management System (ISMS) documentation to reflect service modifications.
- Review and amend “Right to Audit” clauses and IAM roles if a supplier changes their underlying infrastructure or sub-processors.
4. Manage Service Levels and Incident Remediation
Track and resolve security incidents or performance failures identified during the monitoring phase. This result-focused step ensures that any breach of security by the supplier is met with immediate corrective action.
- Document all supplier-side security events in a centralised Incident Register to track trends and recurring weaknesses.
- Enforce contractual penalties or remediation plans if a supplier fails to meet mandatory security thresholds.
- Verify that the supplier has successfully closed any “non-conformities” identified in their previous audit reports.
5. Formalise Supplier Exit and Decommissioning Strategies
Develop a documented exit plan for critical suppliers to ensure data integrity and security during the termination of services. This action mitigates the risk of “vendor lock-in” and ensures the secure return or destruction of organisational assets.
- Define technical requirements for secure data porting, including file formats and encryption standards.
- Establish a verified process for the revocation of all supplier IAM roles, MFA tokens, and physical access badges.
- Obtain a formal certificate of data destruction for any assets or information retained by the supplier at the end of the contract.
Monitoring Metrics Matrix
| Metric | Description | Frequency | Good Score |
| Uptime (SLA) | Is the service available? | Monthly | > 99.9% |
| Incident Response | How fast do they reply to tickets? | Quarterly | < 4 Hours |
| Security Audits | Do they have a valid ISO 27001 cert? | Annually | Valid / Pass |
| Data Breaches | Have they reported any leaks? | Ad-hoc | 0 |
ISO 27001 Supplier Register Template
The ultimate ISO 27001 Supplier Register Template.
ISO 27001 Supplier Policy Template
The ultimate ISO 27001 Supplier Register Template.
How to comply
To comply with ISO 27001 Annex A 5.22 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to
- Implement a topic specific policy
- Implement a supplier management process
- Include in your supplier management process supplier acquisition and supplier transfer
- Implement an ISO 27001 supplier register
- Have agreements with all suppliers that cover information security requirements
- Have information security assurances for critical suppliers as a minimum and ideally all relevant suppliers
- Monitor those suppliers
- Respond to adverse incidents in a structured way
How to pass an ISO 27001 Annex A 5.22 audit
To pass an audit of ISO 27001 Annex A 5.22 Monitor, review and change management of supplier services you are going to make sure that you have followed the steps above in how to comply.
What the auditor will check
The audit is going to check a number of areas. Lets go through the most common
1. That you have a supplier agreements in place
The auditor is going to check that you have agreements in place with suppliers that cover the information security requirements. It will check that those agreements are in date and cover the products and / or services acquired.
2. That you have an ISO 27001 Supplier Register
You will need an ISO 27001 Supplier Register to record and manage your suppliers. Make sure it is up to date and reflects your reality.
3. Documentation
They are going to look at audit trails and all your documentation and see that is classified and labelled. All the documents that you show them, as a minimum if they are confidential should be labelled as such. Is the document up to date. Has it been reviewed in the last 12 months. Does the version control match.
Top 3 ISO 27001 Annex A 5.22 Mistakes People Make and How to Avoid Them
The top 3 Mistakes People Make For ISO 27001 Annex A 5.22 are
1. You have do not monitor suppliers
Make sure that there are reviews and monitors in place. Perhaps meetings. Perhaps reports. Perhaps dashboards. Be sure to be able to evidence that you review and monitor those suppliers. You will have processes for adverse advents so do not be surprised if you are asked to evidence an adverse event, problem or issue and that you followed your process.
2. You have no assurance they are doing the right thing for information security
Make sure you have done your security assessment and can place your hands on an in date certificate such as an ISO 27001 Certification for assurance they are doing the right thing. It needs to be in date a cover the products and / or services you have acquired and are using form the supplier.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Applicability of ISO 27001 Annex A 5.22 across different business models.
| Business Type | Applicability & Interpretation | Examples of Control |
|---|---|---|
| Small Businesses |
Service Availability & Notifications. You cannot force big vendors (Google, Xero) to change, but you must monitor their performance. Compliance focuses on tracking uptime and reviewing “Terms of Service” updates. |
• Status Dashboards: Checking the “Microsoft 365 Health Status” page during outages rather than just waiting. |
| Tech Startups |
API & Sub-processor Changes. Critical focus on “breaking changes” from infrastructure providers (AWS, Stripe). You must monitor if a vendor changes their sub-processors, which impacts your compliance posture. |
• Automated Alerts: Subscribing to AWS/Heroku “Health Events” via PagerDuty or Slack. |
| AI Companies |
Model & Data Policy Integrity. Monitoring suppliers is existential. If an LLM provider changes their “Data Retention Policy” (e.g., switching from zero-retention to training on inputs), you may immediately violate client contracts. |
• ToS Scanning: Using automated tools or legal review to flag changes in API provider terms regarding “Model Training” rights. |
Fast Track ISO 27001 Annex A 5.22 Compliance with the ISO 27001 Toolkit
For ISO 27001 Annex A 5.22 (Monitoring, review and change management of supplier services), the requirement is to regularly monitor, review, and evaluate supplier information security practices and service delivery. This ensures that the security levels agreed upon in contracts are actually being maintained throughout the life of the relationship.
| Compliance Factor | SaaS Compliance Platforms | High Table ISO 27001 Toolkit | Audit Evidence Example |
|---|---|---|---|
| Evidence Ownership | Rents access to your review history; if you cancel the subscription, your documented vendor performance and SLA logs vanish. | Permanent Assets: Fully editable Word/Excel Supplier Policies and Registers that you own and host forever. | A localized “Supplier Monitoring Log” showing historical uptime performance and certificate expiry dates. |
| Review Governance | Attempts to “automate” monitoring via generic dashboards that cannot attend QBRs or evaluate vendor ownership changes. | Governance-First: Formalizes your existing relationship management (QBRs, SLA reports) into an auditor-ready framework. | A completed “Monitoring Metrics Matrix” proving that a vendor’s security compliance was verified during a quarterly review. |
| Cost Efficiency | Charges a “Vendor Volume Tax” that scales aggressively based on the number of monitored suppliers or third-party reviews. | One-Off Fee: A single payment covers your monitoring governance for 5 critical vendors or 50. | Allocating budget to higher-tier vendor support or security upgrades rather than monthly “SLA dashboard” fees. |
| Strategic Freedom | Mandates rigid review cycles and scoring systems that may not align with your specific industry SLAs or business needs. | 100% Agnostic: Procedures adapt to your workflow—from deep-dive annual audits to simple quarterly metric checks. | The ability to evolve your vendor review strategy (e.g., adding new ESG or security KPIs) without reconfiguring a rigid SaaS module. |
Summary: For Annex A 5.22, the auditor wants to see that you are actively monitoring your suppliers and have a process for managing changes to their services. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.
ISO 27001 Annex A 5.22 FAQ
What is ISO 27001 Annex A 5.22?
ISO 27001 Annex A 5.22 is a governance control that mandates organisations regularly monitor, review, and manage changes to supplier service delivery to maintain information security standards.
- Monitoring supplier performance against agreed service levels (SLAs).
- Reviewing supplier security reports and independent audit results.
- Managing changes to the service or technology provided by the supplier.
- Ensuring the risk level of the partnership remains within acceptable boundaries.
What are the mandatory monitoring requirements for Annex A 5.22?
To comply with Annex A 5.22, organisations must implement a formalised process to track service levels, security incidents, and audit reports provided by the supplier.
- Tracking service availability and operational performance.
- Monitoring security incident reports and response times.
- Reviewing independent audit evidence, such as SOC 2 or ISO 27001 certificates.
- Analysing audit logs and security event data related to the service.
How often should supplier security reviews be conducted?
Supplier security reviews should be conducted at least annually, though the frequency should be increased based on the risk classification and criticality of the service.
- Critical/High-Risk Suppliers: Quarterly or bi-annual reviews.
- Medium-Risk Suppliers: Annual formal reviews.
- Low-Risk Suppliers: Annual check of certificate validity.
- Event-Based: Reviews triggered by security incidents or major service changes.
How do you manage changes to supplier services?
Managing supplier changes involves a formal impact assessment of any alterations to the service, technology, or contract before they are implemented.
- Assessing the security risks introduced by the proposed change.
- Updating existing risk assessments and ISMS documentation.
- Verifying that existing security controls remain effective after the change.
- Amending service level agreements (SLAs) or contracts where necessary.
What is the difference between Annex A 5.21 and 5.22?
Annex A 5.21 focuses on the initial security requirements and contract terms, whereas Annex A 5.22 focuses on the ongoing performance management and change control of those services.
- 5.21: The “Front-end” contract and onboarding security requirements.
- 5.22: The “Life-cycle” monitoring and operational review of the supplier.
- Combined: Both controls ensure end-to-end supplier relationship security.
What evidence do auditors expect for Annex A 5.22 compliance?
Auditors expect to see a documented trail of performance reviews, updated risk assessments, and evidence that service changes were assessed for security impact.
- Minutes or notes from supplier performance review meetings.
- Service level performance dashboards and reports.
- Records of reviewing supplier audit certificates (ISO 27001, SOC 2).
- Documentation of formal change requests and their security sign-offs.
Can I rely on a supplier’s own security audit reports?
Yes, you can rely on third-party audit reports like SOC 2 Type II or ISO 27001 certificates, provided you verify that the scope covers the specific services your organisation uses.
- Confirm the scope of the certificate matches your service usage.
- Review the “User Entity Controls” (UECs) for actions you must take.
- Ensure the certificate is current and hasn’t expired.
- Check for any reported non-conformities or security weaknesses.
Related ISO 27001 Controls
ISO 27001 Annex A 5.19 Information Security In Supplier Relationships
ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements
ISO 27001 Annex A 5.21 Managing Information Security In The ICT Supply Chain
Further Reading
ISO 27001 Supplier Security Policy Beginner’s Guide
ISO 27001 controls and attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Identify | Supplier relationships security | Protection |
| Integrity | Governance and ecosystem | |||
| Availability | Defence | |||
| Information security assurance |
