Information security in supplier relationships

Plain-language summary

Managing the information security risk that comes with every supplier whose product or service touches your information — from the managed IT provider with domain-admin rights to the shredding company and the payroll bureau — through a defined process that runs from selection to exit.

What the clause is really asking

Many of the breaches that make the news start at a supplier, and this control is the umbrella for the supplier family (5.19 to 5.23). It asks you to define and run processes for managing the information security risks of using suppliers' products and services, usually anchored in a topic-specific supplier policy. In practice that means knowing which suppliers you have and what access or information each one gets; tiering them by risk so the cleaning contractor and the cloud ERP host are not treated alike; setting security requirements before selection; checking the supplier can meet them; managing the relationship while it runs; and closing it properly, with access removed and information returned or destroyed. The common misunderstanding is that the ISO 9001 approved-supplier list already covers this; it covers quality and delivery, rarely access and data. In South Africa, any supplier that processes personal information on your behalf is an operator under POPIA sections 20 and 21, and you remain accountable for what it does with that information.

What auditors look for

Auditors ask for the supplier policy and the supplier register, then pick three suppliers with real access — typically the IT managed service provider, a cloud host and a payroll or HR bureau — and trace each from selection to today. They want to see the risk tier, the security requirements set before the contract, the due diligence done (questionnaire, certificate, SOC report), the contract clauses, and evidence that someone has looked at the relationship since. They cross-check the register against accounts payable to find suppliers nobody tiered. The hard question: which suppliers can reach your network or personal information right now, and how do you know their access ends when the contract does?

Typical evidence

Supplier relationships policy; supplier register with service, information accessed, access type and risk tier; due-diligence records per tier (security questionnaires, ISO 27001 certificates, SOC reports); risk assessments for critical suppliers; signed contracts and operator agreements; onboarding and offboarding records showing access granted and removed; certificates of information return or destruction at exit.

How to comply — recommendations

Write a two-page supplier security policy that defines three risk tiers by access and data (for example: privileged or network access; holds personal or confidential information; no access) and the minimum checks for each tier. Build the register by exporting twelve months of payments from accounts payable and marking which suppliers touch information. For tier-one suppliers, send a short security questionnaire or collect a current certificate before signing, and record the decision. Add supplier offboarding to your leaver process so accounts, VPN profiles and access cards are removed on the contract end date. Review the register and tiers once a year, and whenever a supplier's service or access changes.

Common nonconformities

No supplier security policy or risk tiering; supplier register incomplete when compared with accounts payable; no due diligence before engaging a supplier with privileged access; operators processing personal information without POPIA-compliant agreements; supplier accounts still active after the contract ended; no evidence of information returned or destroyed at exit; approved-supplier list covering quality and delivery only.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.