Auditing Supplier and Third-Party Information Security
Five controls carry supplier security, and they divide the relationship into stages: the requirements and the assessment, the agreement, the chain behind the supplier, the years after signature, and cloud services specifically. Evidence that answers one of the five frequently answers none of the others, which is why supplier findings so often get cited at the wrong control.
Five controls carry supplier security, and they divide the relationship into stages: the requirements and the assessment, the agreement, the chain behind the supplier, the years after signature, and cloud services specifically. Evidence that answers one of the five frequently answers none of the others, which is why supplier findings so often get cited at the wrong control.
The organisation in the worked finding on this page is invented, and so is the finding.
The five ISO 27001 supplier controls, and where each begins and ends
| Control | What it owns |
|---|---|
| A.5.19 Information security in supplier relationships | Processes and procedures to manage the information security risks associated with the use of a supplier’s products or services |
| A.5.20 Addressing information security within supplier agreements | What is established and agreed with each supplier, according to the type of supplier relationship |
| A.5.21 Managing information security in the ICT supply chain | The parties behind the supplier, and the risks associated with the supply chain of ICT products and services |
| A.5.22 Monitoring, review and change management of supplier services | Everything after signature: regular monitoring, review, evaluation, and managing change in the supplier’s practices and service delivery |
| A.5.23 Information security for use of cloud services | Processes for acquisition, use, management and exit from cloud services. It sits alongside the other four rather than replacing them |
Start at the Statement of Applicability. All five are controls the organisation selected at Clause 6.1.3, and what it claims about each is your first criterion. Watch for the same evidence appearing against more than one of the five: an onboarding assessment cited under A.5.19, A.5.21 and A.5.22 alike is a claim about one control and a gap in two.
Where supplier audit time usually goes under ISO 27001, and where it should
Supplier auditing gravitates towards the beginning of the relationship, because that is where the documents are. A register exists, contracts exist, assessments were done because somebody had to sign something off. All of it is auditable and most of it is in reasonable order.
The requirements do not stop at signature. A.5.21 and A.5.22 cover the period afterwards — the chain behind the supplier, and what the organisation has done since — and neither leaves a document behind unless somebody decided it should. They are commonly marked applicable and evidenced with the same assessment that covers A.5.19.
Two questions do most of the work in this area, and neither has a rehearsed answer.
What has this supplier’s information security looked like since we onboarded them? Not the contract, not the assessment — what the organisation has done since.
Who is behind them? The supplier’s own suppliers, and what the organisation knows or requires about changes to that chain.
Want structured preparation?One year of LMS access and HD recordings come with the course.
A worked ISO 27001 finding on Annex A.5.21
Ilminster Diagnostics operates a pathology reporting service, with a supplier register, security requirements applied at onboarding, and agreements reviewed by legal.
| Statement | Risks associated with the ICT supply chain behind the organisation’s suppliers are not managed. |
|---|---|
| Objective evidence | The supplier management procedure addresses direct suppliers and contains no requirement concerning parties engaged by them. Nine suppliers with access to pathology data or to systems processing it were examined. For seven, no information about sub-processing or onward engagement was held. For the remaining two, the agreements permit onward engagement with notice, and no notices were produced or recalled. The provider of the reporting portal confirmed on the audit day that a separate company in another jurisdiction holds standing administrative access to the portal for out-of-hours platform support; the head of information technology stated that the organisation had not known this and that no requirement to disclose such an engagement exists in any of its agreements. The risk assessment records no risk relating to the supply chain behind any supplier, and the supplier register has no field for it. |
| Requirement | ISO/IEC 27001 Annex A.5.21 requires the organisation to define and implement processes and procedures to manage the information security risks associated with the ICT products and services supply chain. |
| Grade | Major — the organisation has no process addressing the supply chain behind its suppliers at all, so the requirement is unperformed rather than inconsistently performed; the disclosure on the audit day is recorded because it shows the gap has already produced an exposure the organisation was unaware of, not because a single instance would carry the grade. |
Note what this finding does not say. It does not assert that the third party’s access is a breach, that it has been misused, or that anything has gone wrong at the provider. All of that would be an audit of somebody the organisation has no agreement with and you have no standing over. What is auditable is that the organisation had no process capable of knowing, and the disclosure is evidence of that and nothing more.
What a minor on the same control would look like. A process for the supply chain that exists and operates, with one supplier’s onward engagement unrecorded; or disclosure required in the agreements and one notice not followed up. Here there is no process to have a gap in, which is what separates the two.
One discipline in writing any of these. What you were told belongs in the box where it establishes reach; why you think it happened does not. The head of information technology’s account that no disclosure requirement exists is recorded because it establishes reach across all nine suppliers, not just the one.
What an ISO 27001 supplier assessment has to show
An assessment is a common piece of evidence, and it is worth being clear about what makes one evidence at all. A.5.19 asks for processes and procedures to manage the information security risks of using a supplier’s products or services. An assessment evidences that process where its criteria, its conclusion and what followed from it are recorded; where they are not, what exists is a completed form rather than a decision.
The same holds for a certificate or assurance report the organisation holds about a supplier. Holding one is not a control. What the requirement reaches is what the organisation did with it: whether it read the scope against its own requirements, and what it concluded.
Not sure about the course yet?One year of free retraining on the same exam version is included.
The audit trail for ISO 27001 supplier security
Start with the register, and test it against something outside itself. A list of suppliers held by procurement, a list held by IT and a list of what is actually being paid for are three different documents in most organisations, and the difference between them is where this audit begins.
Then take the period since onboarding. A.5.22 asks for regular monitoring, review and evaluation, and for change in the supplier’s practices and service delivery to be managed. What the organisation set itself is the criterion; what it has done since is the evidence.
Then ask about the chain. A.5.21 covers the ICT products and services supply chain, which means the parties engaged by the parties the organisation engaged. What its agreements require to be disclosed, and what it knows, are two separate questions with two separate answers.
Where the ISO 27001 supplier controls meet the clauses
| Requirement | What it adds |
|---|---|
| Clause 4.2 | A supplier can be an interested party whose requirements the ISMS has to address |
| Clause 4.3 | Interfaces and dependencies with other organisations are the third consideration in determining scope |
| Clause 8.1 | Externally provided processes, products or services relevant to the ISMS must be controlled — a separate requirement from the annex controls, and capable of a separate finding |
| Clause 6.1.2 | The risks the supplier introduces are risks like any others, with owners |
| A.5.14 | Information transfer, which is how the supplier gets what it holds |
| A.8.30 | Outsourced development, where what is bought is software rather than a service |
Clause 8.1 is the one people forget. It is not a supplier control and it is not satisfied by pointing at one: it asks whether the organisation controls externally provided processes, products and services relevant to the ISMS. The annex controls describe arrangements; 8.1 asks whether the organisation is actually controlling the thing.
Major or minor in an ISO 27001 supplier finding
Major territory: a whole category of supplier outside any process; no arrangement covering the chain behind suppliers at all; the monitoring and review the organisation set itself performed for none of the suppliers it applies to.
Minor territory: one supplier missing from a register that is otherwise maintained; one review late in a schedule that runs; an assessment completed without its conclusion recorded.
Escalation: the same gap after onboarding across several suppliers is one finding about A.5.22, not five.
And the criteria are the standard, the organisation’s own requirements and its contractual obligations — not your view of what a supplier ought to be doing. The distinction matters here because you are two steps removed from the thing you are curious about, and the auditee knows it.
ISO 27001 supplier controls: where does each begin and end?
Pick a supplier control to see what it owns.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. A.5.23 sits alongside the other four supplier controls rather than replacing them.
Frequently asked questions about auditing supplier and third-party security under ISO 27001
Which ISO 27001 controls cover suppliers?
Five: A.5.19 the processes for managing supplier risk, A.5.20 what is agreed with the supplier, A.5.21 the ICT supply chain behind them, A.5.22 monitoring and review after onboarding, and A.5.23 cloud services specifically.
Can I audit the organisation’s suppliers in an ISO 27001 audit?
No. You have no audit agreement with them. What is auditable is the organisation’s management of the relationship — what it required, what it agreed, what it knows about the chain, and what it has done since.
Does a supplier’s certificate satisfy the ISO 27001 requirement?
It is information the organisation may rely on, not a substitute for the requirement. What matters is whether the organisation read its scope against its own requirements and recorded a conclusion. A certificate on file with no conclusion drawn from it is a document.
Where does ISO 27001 Clause 8.1 fit in supplier management?
It requires externally provided processes, products or services relevant to the ISMS to be controlled. That is a management system requirement separate from the annex controls, and the same evidence can support findings at both. They are answered by different people.
Which ISO 27001 supplier control is most often weak?
A.5.22, monitoring and review after onboarding, and A.5.21, the chain behind the supplier. Both cover the period when nothing forces an activity to happen, and neither leaves a document behind unless the organisation has decided it should.
The other ISO 27001 control areas
auditing backup and recoverability
For the controls behind these areas, the four Annex A theme pages set out what each group requires: the A.5 organizational controls, the A.6 people controls, the A.7 physical controls, the A.8 technological controls.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply