What is a Supplier Agreement?

A supplier agreement is a contract between a company and an external provider for goods or services. When these goods or services involve sensitive data or critical systems, the agreement must include specific clauses to ensure the supplier follows the same security standards as the company. This helps protect the company’s information from being compromised by a third party.

Examples

Cloud Service Provider (CSP): A company that uses a CSP to store customer data needs a supplier agreement that outlines how the CSP will secure that data, including encryption, access controls, and data backup procedures.
Managed IT Service Provider (MSP): When an MSP handles a company’s network, the agreement should specify security measures like regular vulnerability scans, patching schedules, and incident response protocols.
Marketing Agency: A marketing agency that gets access to a company’s customer list for an email campaign must have an agreement that details how they’ll protect that list and what they’ll do with it after the campaign ends.

Context

In the world of business, it’s common to work with other companies. This is called a supply chain.

Even if your company is very secure, a weak link in the supply chain can put your information at risk. A strong supplier agreement makes sure all your partners are also protecting your information. It’s a key part of managing risk and building trust with your customers.

Relevant ISO 27001 Controls

The following controls from the ISO/IEC 27001:2022 standard are related to supplier agreements:

ISO 27001 Annex A 5.19 Information Security In Supplier Relationships: This control requires a company to have a clear policy on how it will manage information security risks with its suppliers.
ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements: This control makes it a requirement to include information security requirements in all supplier agreements.
ISO 27001 Annex A 5.21 Managing Information Security In The ICT Supply Chain: This control requires a company to have a clear policy on how it will manage information security risks with its IT suppliers.
ISO 27001 Annex A 5.22 Monitor, Review And Change Management Of Supplier Services: This control states that companies should regularly check to make sure their suppliers are meeting the security requirements set out in the agreement.
ISO 27001 Annex A 5.23 Information Security For Use Of Cloud Services: This control requires a company to have a clear policy on how it will manage information security risks with its cloud suppliers.

About the author

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.