TPRM maturity check: Take the check
Trestec
Book a demo
Server racks in a data centre

ISO 27001 supplier controls

Supplier relationships within an information security management system.

Book a demoTalk to us

Overview

ISO/IEC 27001 is the international standard for information security management systems.

The current edition, ISO/IEC 27001:2022, was published in October 2022. Its main body (clauses 4 to 10) sets requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).

Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). Organisations select controls through risk treatment and record their choices in a statement of applicability.

Supplier relationships are addressed in Annex A controls 5.19 to 5.23, covering supplier security, supplier agreements, the ICT supply chain, monitoring of supplier services, and the use of cloud services. Guidance on each control is in ISO/IEC 27002:2022.

Applies to

  • Organisations certified to ISO/IEC 27001, or working towards it
  • Suppliers asked to evidence information security
  • Organisations using ISO/IEC 27001 as a reference framework without seeking certification

Scope and applicability

Confirm the requirements that apply to your entity, the service and the arrangement before selecting the depth of review. How the rules apply depends on your entity.

Key dates

25 October 2022

ISO/IEC 27001:2022 published

February 2024

Amendment 1 adds climate change considerations to clauses 4.1 and 4.2

31 October 2025

End of transition from ISO/IEC 27001:2013

Every 3 years

Recertification audit, with surveillance audits in between

Inside the regulation

Structure of the standard

Clauses 0 to 3 cover the introduction, scope, normative references and terms. Clauses 4 to 10 contain the requirements: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. They follow the harmonised structure shared with other ISO management system standards such as ISO 9001.

Annex A lists the reference controls. Organisations are not required to implement every control, but must consider them all and justify exclusions in the statement of applicability.

Supplier controls in practice

Controls 5.19 to 5.22 describe a lifecycle: identify supplier types and their risks, agree security requirements in contracts, manage risks that flow down the ICT supply chain, and monitor and manage change in supplier services.

Control 5.23 extends this to cloud services, including how cloud services are selected, how responsibilities are shared with the provider, and how the organisation would exit.

Certification

Certification is carried out by certification bodies, ideally accredited by a national accreditation body such as UKAS in the United Kingdom. A certificate is typically valid for three years, with surveillance audits at least annually.

Detailed requirements

01

Context and scope (clause 4)

Determine internal and external issues, interested parties and their requirements, and the scope of the ISMS, including interfaces and dependencies with activities performed by other organisations.

02

Leadership (clause 5)

Top management demonstrates leadership and commitment, sets the information security policy and assigns roles and responsibilities.

03

Risk assessment and treatment (clause 6)

Define and apply an information security risk assessment and treatment process, and produce a statement of applicability justifying the inclusion or exclusion of Annex A controls.

04

Operation (clause 8)

Plan and control the processes needed to meet requirements, including externally provided processes, products or services relevant to the ISMS.

05

Information security in supplier relationships (5.19)

Define and implement processes to manage the information security risks associated with the use of suppliers’ products or services.

06

Security within supplier agreements (5.20)

Establish and agree relevant information security requirements with each supplier, based on the type of supplier relationship.

07

ICT supply chain (5.21)

Define and implement processes to manage information security risks associated with the ICT products and services supply chain.

08

Monitoring and change management (5.22)

Regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

09

Use of cloud services (5.23)

Establish processes for the acquisition, use, management and exit from cloud services in line with information security requirements.

10

Outsourced development (8.30)

Direct, monitor and review activities related to outsourced system development.

11

Performance evaluation and improvement (clauses 9 and 10)

Monitor and measure the ISMS, carry out internal audits and management reviews, and address nonconformities through corrective action.

How Trestec supports it

Requirement

Supplier inventory

How Trestec supports it

Register of suppliers with data access and criticality

Module

Supplier mapping

Requirement

Security assessment

How Trestec supports it

Security questionnaires and evidence review

Module

Due diligence

Requirement

Certifications

How Trestec supports it

ISO and SOC reports tracked with expiry alerts

Module

Due diligence

Requirement

Security in agreements

How Trestec supports it

Security clauses checked in each contract

Module

Contract oversight

Requirement

ICT supply chain

How Trestec supports it

Subcontractors and hosting providers mapped

Module

Supplier mapping

Requirement

Risk treatment

How Trestec supports it

Supplier risk rated with reasons and owners

Module

Risk assessment

Requirement

Service monitoring

How Trestec supports it

Review dates and change alerts

Module

Risk assessment

Requirement

Audit evidence

How Trestec supports it

Records ready for internal and certification audits

Module

Due diligence

Requirement

Cloud services (5.23)

How Trestec supports it

Cloud providers recorded with exit terms and hosting locations

Module

Contract oversight

Requirement

Certificate scope checks

How Trestec supports it

Supplier certificate scope reviewed against the service provided

Module

Due diligence

Illustrative mapping, not a compliance determination.

Supervisory review: gaps to examine

Illustrative review questions, not findings from a supervisor.

No supplier tiers

Low-risk and high-risk suppliers reviewed the same way.

Expired reports

SOC 2 or ISO certificates out of date.

Generic contracts

No specific security requirements agreed.

Cloud providers missed

Hosting behind SaaS suppliers not recorded.

Certificate scope not checked

A supplier’s certificate does not cover the service, site or entity actually used.

No cloud exit

Cloud services adopted without documented exit arrangements, as 5.23 expects.

Monitoring not evidenced

Supplier reviews happen informally, with no record for auditors.

Statement of applicability out of date

Supplier controls excluded or included without a current justification.

Evidence you can produce

  • Supplier register
  • Security questionnaires
  • Certificates with dates
  • Contract security clauses
  • Subcontractor map
  • Risk ratings
  • Review history
  • Audit packs
  • Statement of applicability entries for supplier controls
  • Cloud service exit arrangements

Common questions

Related modules

Due diligence

Collect supplier evidence in a guided portal and review it in context.

Contract oversight

Review supplier obligations, renewal dates and regulatory clauses together.

Supplier mapping

See your suppliers, their subcontractors and the infrastructure they share.

Risk assessment

Make materiality and risk decisions with the evidence in view.

See Trestec on your own supplier list.

Book a demoTalk to us