ISO 27001 Annex A 5.19 to 5.22: supplier security controls explained

ISO/IEC 27001:2022 Annex A 5.19 to 5.22 are the four controls that govern your suppliers from the first conversation to the last review: choose them through a defined process, write the security requirements into the agreement, look one level down the supply chain, and keep checking. Each has its own page in this library. This guide puts the four side by side, because that is how they are run and how a certification auditor tests them.

Below: the four controls in a table, what each one requires in plain language, how they connect, one supplier traced through all four, the common nonconformities, and an evidence checklist for the set. It assumes the 2022 edition. It is general guidance on the standard, not a substitute for reading ISO/IEC 27001 and 27002 or for your certification body’s view.

The four controls at a glance

The titles above are the standard’s. The fifth supplier-related control, 5.23 (Information security for use of cloud services), was new in 2022 and is covered in ISO 27001 Annex A 5.23: Information security for use of cloud services. For all five together with a supplier questionnaire outline, read ISO 27001 vendor management: meeting Annex A 5.19 to 5.23 with evidence.

One process, four controls

The controls map onto the life of a supplier relationship. Reading them in order is the quickest way to see what each one adds.

1. Select (5.19). Before a supplier is engaged, decide whether it matters for information security and how much. That means knowing the types of supplier you use, classifying them by the information and services involved, and applying a level of assessment that matches.
2. Contract (5.20). Turn what the assessment found you need into terms the supplier agrees to: how your information is protected, who can access it, how incidents are reported, what happens at the end.
3. Look down the chain (5.21). For ICT products and services, your supplier’s own suppliers and components can carry the risk. Know the critical ones and require the supplier to pass your requirements on.
4. Keep watching (5.22). Review the supplier on a cadence set by its tier, and re-assess when something changes: a new sub-processor, an incident, a change to the service, or a certification that lapses.

Each step produces a record, and the records are what the auditor samples. A process that runs but leaves nothing behind is, for audit purposes, a process that did not run.

Annex A 5.19: the supplier process

The control asks for processes and procedures to manage the information security risks associated with the use of suppliers’ products or services. ISO/IEC 27002:2022 guidance expects you to identify the types of supplier that can affect your information security, decide how they are evaluated and selected, define the requirements each type must meet, and handle incidents, contingencies and the end of a relationship.

In a small or mid-sized company that is a short supplier security procedure, a complete supplier register with a risk tier for each supplier, and assessment records for the higher tiers. Vendor risk tiering: how to classify third parties and set a review cadence sets out tier criteria that hold up, and ISO 27001 Annex A 5.19: Information security in supplier relationships covers the control in depth.

Annex A 5.20: the security terms in each agreement

The control asks that relevant information security requirements be established and agreed with each supplier, based on the type of relationship. The useful words are “relevant” (requirements scale with the tier) and “agreed” (an internal expectation never put to the supplier does not count).

Define a minimum clause set per tier: confidentiality, the security measures expected, access rules, incident notification within a stated time, sub-contracting conditions, a right to assess or receive independent reports, and return or deletion of information at the end. Check higher-tier agreements against it and log each gap with how it was handled. Where the supplier processes personal data, a DPA that meets GDPR Article 28 covers part of this, but not all of it. More in ISO 27001 Annex A 5.20: Addressing information security within supplier agreements.

Annex A 5.21: the ICT supply chain

The control asks for processes and procedures to manage the information security risks associated with the ICT products and services supply chain. In practice that means two things. For ICT services, the supplier’s own critical suppliers (your fourth parties, such as the cloud host behind a SaaS tool) are known, and the supplier is required to pass relevant security requirements down to them. For ICT products, you consider where components come from and how they are kept up to date.

You are not expected to audit the whole chain. You are expected to know the parts of it that matter, usually from the supplier’s published sub-processor list and its assurance report, and to react when they change. See ISO 27001 Annex A 5.21: Managing information security in the ICT supply chain.

Annex A 5.22: monitoring, review and change

The control asks you to regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery. It combines what the 2013 edition split into two controls, so one record can serve both: a dated review per supplier, on a cadence set by tier, noting what was checked, what changed, and what was decided.

Agree change triggers too, so a review is not only calendar-driven: a security incident at the supplier, a new sub-processor or data location, a material change to the service, a lapsed certificate or a qualified assurance report. More in ISO 27001 Annex A 5.22: Monitoring, review and change management of supplier services.

One supplier, traced through all four

This is roughly what a certification auditor will ask for when sampling a critical supplier, here a hosted payroll service:

If every row has an answer you can open in under a minute, the sample usually passes. The most common failure is not a missing control but a missing record: the review was done in a meeting and never written down.

Common nonconformities

• 5.19: a supplier register that misses suppliers an auditor can find in accounts payable or single sign-on logs; tiers with no stated criteria.
• 5.20: critical suppliers on their own terms with no record of a clause check, or a minimum clause set that exists but was never applied.
• 5.21: no knowledge of the hosting or key sub-processors behind critical SaaS suppliers.
• 5.22: reviews that are overdue against your own stated cadence, or supplier changes that never triggered a review.

Evidence checklist for 5.19 to 5.22

• Approved supplier security procedure with an owner, supplier types, tiers and criteria (5.19)
• Complete supplier register: tier, owner, information handled, last and next review (5.19)
• Dated assessment records with a conclusion for critical and high-tier suppliers (5.19)
• Minimum security clause set per tier, and a clause check with gap log for each higher-tier agreement (5.20)
• Record of critical fourth parties for ICT suppliers, and the flow-down requirement in the agreement (5.21)
• Dated supplier reviews on the cadence your procedure sets, with outcomes (5.22)
• Records of supplier changes and the reassessment each one triggered (5.22)

Where to go next

To set up the process these controls describe, start with Vendor risk management policy template: ten sections you can copy and adapt for procedure text and Vendor risk assessment questionnaire: what to ask, and how to score the answers for the questions to send. To vet a single new supplier end to end, follow How to vet a vendor: a step-by-step vetting checklist. If you also report under SOC 2, SOC 2 vendor management: what auditors expect from your third-party programme shows where the evidence overlaps.