A supplier agreement is a contract between a company and an external provider for goods or services. When these goods or services involve sensitive data or critical systems, the agreement must include specific clauses to ensure the supplier follows the same security standards as the company. This helps protect the company’s information from being compromised by a third party.
Examples
- Cloud Service Provider (CSP): A company that uses a CSP to store customer data needs a supplier agreement that outlines how the CSP will secure that data, including encryption, access controls, and data backup procedures.
- Managed IT Service Provider (MSP): When an MSP handles a company’s network, the agreement should specify security measures like regular vulnerability scans, patching schedules, and incident response protocols.
- Marketing Agency: A marketing agency that gets access to a company’s customer list for an email campaign must have an agreement that details how they’ll protect that list and what they’ll do with it after the campaign ends.
Context
In the world of business, it’s common to work with other companies. This is called a supply chain.
Even if your company is very secure, a weak link in the supply chain can put your information at risk. A strong supplier agreement makes sure all your partners are also protecting your information. It’s a key part of managing risk and building trust with your customers.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to supplier agreements:
ISO 27001:2022 Annex A 5.19 Information Security In Supplier Relationships: This control requires a company to have a clear policy on how it will manage information security risks with its suppliers.
ISO 27001:2022 Annex A 5.20 Addressing Information Security Within Supplier Agreements: This control makes it a requirement to include information security requirements in all supplier agreements.
ISO 27001:2022 Annex A 5.21 Managing Information Security In The ICT Supply Chain: This control requires a company to have a clear policy on how it will manage information security risks with its IT suppliers.
ISO 27001:2022 Annex A 5.22 Monitor, Review And Change Management Of Supplier Services: This control states that companies should regularly check to make sure their suppliers are meeting the security requirements set out in the agreement.
ISO 27001:2022 Annex A 5.23 Information Security For Use Of Cloud Services: This control requires a company to have a clear policy on how it will manage information security risks with its cloud suppliers.
