Supplier management under ISO 27001
Almost every organisation works with suppliers that have access to information or systems: cloud providers, IT service providers, payroll processors, cleaning companies. ISO 27001 requires you to also manage their security risks. The relevant controls are in Annex A, sections A.5.19 to A.5.23. The NEN version of the standard (the Dutch standards institute) gives the formal text, and ISO 27002 provides implementation guidance.
Supplier management regularly produces findings in internal audits and certification audits. This is not because it is technically complicated. It is because organisations forget about it or fill it in superficially.
The five controls A.5.19 to A.5.23
| Control | Topic | Core message |
|---|---|---|
| A.5.19 Information security in supplier relationships | Policy for supplier relationships | Set requirements before you engage a supplier |
| A.5.20 Addressing information security within supplier agreements | Contracts | Record security requirements in contractual agreements |
| A.5.21 Managing information security in the ICT supply chain | Supplier chains | Manage the risks in your suppliers’ chains |
| A.5.22 Monitoring, review and change management of supplier services | Ongoing relationships | Check regularly whether suppliers still meet your requirements |
| A.5.23 Information security for use of cloud services | Cloud providers | Specific requirements for cloud-based services |
A.5.23 is a new control in the 2022 version of ISO 27001. It reflects that most organisations now depend heavily on cloud providers, and that these risks need specific attention.
Why supplier management matters
Attacks through the supply chain are increasing. The SolarWinds attack in 2020 and the Log4Shell vulnerability in 2021 showed that one compromised supplier can affect thousands of organisations. ISO 27001 recognises this. A.5.19 requires a policy for managing the risks linked to suppliers that have access to your information.
But it is not only about hackers. A payroll processor that stores personal data carelessly, a cleaning company that unknowingly has access to sensitive areas, or a SaaS tool without an AVG-compliant data location: these are all supplier risks. The AVG is the Dutch name for GDPR.
Supplier assessment: what do you assess?
Before you engage a supplier, especially if it will get access to information in scope, assess its security level.
| Type of supplier | Minimum to assess |
|---|---|
| Cloud provider (IaaS/PaaS) | Certifications (ISO 27001, SOC 2), data location, data processing agreement, incident procedure |
| SaaS provider | Certifications, security page (trust centre), data processing agreement, sub-processors |
| IT service provider with access to systems | Background screening of staff, confidentiality agreement, access management policy |
| Physical access (cleaning, facilities) | Access policy, screening, awareness |
Always record an assessment in the supplier register. A few sentences per supplier is enough for small risks. For critical suppliers, you want more detailed documentation.
Example: supplier register
A supplier register is not an elaborate system. A spreadsheet with the columns below is enough for most organisations.
| Supplier | Type | Access to | Risk classification | Agreement | Certification | Review date |
|---|---|---|---|---|---|---|
| AWS eu-west-1 | IaaS | Production infrastructure | High | Data processing agreement + SLA | ISO 27001, SOC 2 | 15 January 2026 |
| HiBob | SaaS HR | Employee data | High | Data processing agreement | ISO 27001 | 1 February 2026 |
| Caretaker BV | Cleaning | Office | Low | Confidentiality agreement | n/a | 1 March 2026 |
The risk classification determines how closely you monitor the supplier. You assess a critical cloud provider every year. A cleaning company without access to IT systems needs less attention.
Contracts and data processing agreements
ISO 27001 A.5.20 requires that security requirements are recorded in contracts. For suppliers that process personal data, a data processing agreement is also mandatory under the AVG (Article 28).
At a minimum, a supplier contract contains:
- The obligation to comply with the agreed security requirements
- The obligation to report incidents, including a timeline
- The right to audit, or evidence of certification
- Rules on engaging sub-processors
- Agreements on termination and the return of data
For cloud providers such as AWS, Microsoft Azure or Google Cloud, data processing agreements are available as standard in their portal. Check that the data location (EU) and the security requirements match your ISMS scope.
Cloud providers (A.5.23)
The new control A.5.23 gives specific attention to cloud services. For each cloud provider, establish:
- Which shared responsibility model applies? (IaaS: you manage the OS; PaaS: the provider manages the platform)
- Where is data stored? (Require an EU data location when processing personal data)
- How does the provider handle incidents?
- What are the availability SLAs?
- What does the exit strategy look like?
Recording this in the supplier register is sufficient as evidence.
A common mistake is classifying all cloud providers as “low risk” because they are large and well known. AWS or Azure are large and well secured, but you are responsible for what you build on their platform. Responsibility does not stop at the supplier.
Monitoring suppliers
A.5.22 requires regular monitoring of suppliers. That does not mean you carry out an audit at every supplier every quarter. Proportionate monitoring means:
- High risk: an annual assessment, including checking certifications and incident history
- Medium risk: an assessment every two years
- Low risk: an assessment when the contract is renewed
When a supplier has a security incident, gets a new owner or significantly changes its services, an interim assessment is in order.
Supplier management and your risk analysis
Supplier risks belong in your risk register. Identify the risks per critical supplier: what if this supplier has a data breach? What if it fails? What if it stops trading? Link the risks to controls, such as the supplier contract, back-up and exit strategy, and register them.
More information
- Annex A: all 93 controls, including A.5.19 to A.5.23
- Risk analysis: supplier risks in the risk register
- Requirements of the standard: clause 8 on operation
- NIS2 and ISO 27001: NIS2 (the EU cybersecurity directive) also requires supply chain security
- ISO 27002:2022 : implementation guidance per control