A.5.20 Addressing information security within supplier agreements

Control objective

Because a supplier that handles the organization's information or runs part of its IT environment carries the organization's risk without being under the organization's own controls, the information security requirements that match the nature and risk of that relationship must be written into the contract or agreement and agreed with the supplier. This control aims to control supply chain risk in advance and to clarify each party's obligations and accountability by documenting security responsibilities, control levels, incident notification, audit rights, and termination actions from the contracting stage. The essence is to enforce, as contractual terms, requirements proportionate to the access scope and the sensitivity of the information, rather than relying on verbal agreements or informal practice.

Key checkpoints

Are the information security requirements to be included in agreements defined according to supplier type, access level, and the sensitivity of the information handled?
Does the contract or the supplementary security agreement specify, in concrete terms, confidentiality, the scope of access rights, incident notification, audit/inspection rights, and control of subcontracting (further outsourcing)?
Are the security control levels and performance criteria the supplier must meet (policy/standard/SLA) linked to the contract and defined in a measurable way?
Are procedures for return/disposal of information, revocation of access rights, and return of assets on contract termination or cancellation stipulated in the agreement?
Are there clauses for action, remediation, and sanctions in case of a requirement change or a breach during contract performance?
For suppliers that process personal data or regulated information, are legal/regulatory requirements (outsourcing clauses, cross-border transfer, and similar) reflected in the contract?

Implementation guidance

Perform a per-supplier risk assessment before contracting, derive a list of security requirements proportionate to the access scope and information sensitivity, and reflect it in the contract terms.
Prepare a standard contract template and a security schedule so that confidentiality, data handling, access control, encryption, log/monitoring, and vulnerability and patch management are stipulated consistently.
Include a prior-approval procedure for subcontracting (further outsourcing) and a clause that flows down equivalent security obligations to sub-suppliers.
Set supplier incident notification deadlines, starting triggers, recipients, channels, and investigation duties with applicable law, contract obligations, and response time in view. Define initial and follow-up notifications early enough for the organization to meet its own external reporting deadlines.
Specify audit/inspection rights, evidence duties, and reassessment conditions, distinguishing certifications such as ISO 27001 from assurance reports such as SOC 2. Review covered services, scope, validity or assessment period, exceptions, and customer control responsibilities.
Include clauses for return/disposal evidence of data, revocation of accounts/access rights, return of assets, and surviving obligations (such as residual confidentiality) on contract termination or cancellation.
When outsourcing the processing of personal data, reflect in the contract the processing purpose/scope, restrictions on further outsourcing, safeguards, and cross-border transfer conditions required by applicable law.

Related controls and attributes

Evidence

Supplier contracts and supplementary security agreements (NDA, personal data processing outsourcing agreement, security schedule, and similar)
Supplier security requirements definition/checklist
Records of pre-contract risk assessment and supplier due diligence results
SLA and security control level agreement documents
Records of prior approval for subcontracting and notification history
Data disposal/return confirmation and access rights revocation records at contract termination

Nonconformity examples

A contract with a supplier that processes sensitive information omits confidentiality and security requirement clauses.
The contract has no incident notification deadline or procedure, delaying awareness and response to incidents on the supplier side.
The supplier's subcontracting is done without prior approval, and security obligations are not flowed down to the sub-supplier.
Supplier accounts and access rights are retained rather than revoked after contract termination.
There is no audit/inspection right clause, so there is no way to confirm whether the supplier meets its security obligations.
A personal data processing outsourcing agreement does not reflect the safeguards or restrictions on further outsourcing required by law.