A.5.19
Information security in supplier relationships
Organizational controlsCheckpoints 6Evidence 5Cases 6
Control objective
Information security in supplier relationships requires the organization to establish and operate policies and procedures for identifying and managing the information security risks that arise from using external providers of products or services. The aim is to consistently control the exposure, alteration, and service disruption risks that occur when suppliers access, process, store, or transmit the organization's assets, across the full lifecycle of the relationship (selection, contracting, operation, termination). The organization should define security requirements commensurate with each supplier type and access scope, and make responsibility and approval for the relationship explicit, so as to prevent breaches propagating through the supply chain.
Key checkpoints
- Are policies and procedures for information security in supplier relationships established, with security requirements defined according to access type, sensitivity of the information handled, and risk level?
- Is the list (inventory) of suppliers that access the organization's information and information processing facilities identified, documented, and kept up to date?
- Are security risks assessed before supplier selection and contracting, with the results reflected in the approval and the contract?
- Are differentiated controls applied according to supplier type (hardware, software, cloud, maintenance, staff augmentation, and so on)?
- Are internal owners and an approval process designated for the initiation, change, and termination of supplier relationships?
- Is the propagation of security requirements to subcontracting (further outsourcing) and lower tiers of the supply chain managed?
Implementation guidance
- Classify suppliers by access scope, sensitivity of information handled, and service criticality, and define a minimum security requirement baseline for each type.
- Operate an inventory that registers every supplier accessing the organization's information or information processing facilities, recording the responsible department/owner, access scope, and contract period.
- Perform security due diligence (checklists, questionnaires, evidence review) at the selection stage and retain the risk assessment results as the basis for approval.
- Document the security controls to require of suppliers (access control, return of assets, incident notification, right to audit, restrictions on subcontracting, and so on) as a standard requirement set and reflect it in contracts/agreements.
- Define the approval and responsibility model (for example RACI) for initiating, changing, and terminating supplier relationships, including procedures for revoking access, returning assets, and destroying data at termination.
- Review the policies and procedures periodically and update them for changes in law, service scope, and risk.
Evidence
- Policy and procedure documents for information security in supplier relationships
- Supplier inventory (including access scope, owner, contract period)
- Records of supplier security due diligence/risk assessment and selection approval documents
- Security requirement baselines and due diligence checklists by supplier type
- Approval records for initiation/termination of supplier relationships and records of access revocation/asset return
Nonconformity examples
- A maintenance vendor that accesses the organization's information systems exists but is not registered in the supplier inventory.
- A supplier security policy exists, but no differentiated requirements are defined by supplier type or risk level, so identical wording is applied to all suppliers.
- Contracts with new suppliers are concluded without any security due diligence or risk assessment.
- Subcontracting (further outsourcing) occurs, but there is no procedure to propagate security requirements to lower-tier suppliers or to approve such arrangements.
- After a supplier relationship has ended, the vendor's accounts and access rights are not revoked and remain active.
- The supplier inventory is outdated, so the vendors actually accessing systems do not match the inventory records.