Monitoring, review and change management of supplier services

Plain-language summary

Keeping watch on suppliers after the contract is signed — checking they deliver the security they promised, reviewing their reports and incidents, and managing changes to their services, locations or subcontractors so the risk you accepted at selection is still the risk you carry.

What the clause is really asking

Due diligence at selection ages quickly: the supplier moves its hosting region, takes on a subcontractor, has a breach or lets its certificate lapse. This control asks you to monitor, review and evaluate suppliers' security practices and service delivery regularly, and to manage changes to the services they provide. That means agreeing what you will look at (service reports, security incidents, audit or assurance reports, certificate status); holding periodic reviews with critical suppliers and recording them; following up problems; and assessing the risk of supplier-side changes before accepting them — new versions, new data centres, new subcontractors, changes to their own controls. Changes you request also go through your own change process. The common misunderstanding is that the annual supplier evaluation score from the ISO 9001 system covers this; it may, if it includes security criteria and incidents, but most measure delivery and quality only. Under POPIA section 21 an operator must tell you when it suspects personal information has been compromised, so supplier incidents should feed straight into your own incident process.

What auditors look for

Auditors pick critical suppliers and ask for the last review: minutes, the service and security reports discussed, actions raised and closed. They check that the supplier's certificate or SOC report on file is current and that someone read the exceptions. They look for supplier changes over the past year — a new subcontractor, a platform migration, a new hosting region — and ask how the risk was assessed before you accepted it. They ask how supplier incidents reach you and pull any that did. The hard question: when did you last tell a supplier its security was not good enough, and what happened next?

Typical evidence

Supplier review schedule by tier; minutes or records of periodic reviews with critical suppliers; service level and security reports received; current certificates and assurance reports with exceptions noted; supplier incident notifications and follow-up; risk assessments of supplier-initiated changes; change requests for organisation-initiated changes to supplier services; review actions and their closure.

How to comply — recommendations

Set a review frequency by tier in the supplier policy: quarterly for the few suppliers with privileged access or large volumes of personal information, annually for other tier-one suppliers, at renewal for the rest. Use a one-page review template covering service performance, incidents, certificate or assurance status, changes notified and open actions. Keep a diary of certificate expiry dates and chase new ones before they lapse. Require suppliers to notify you of material changes, and assess each one before accepting it. Raise problems as actions with owners and dates. Add security criteria to the existing ISO 9001 supplier evaluation so one review covers both.

Common nonconformities

No reviews of critical suppliers since contract signature; supplier certificates or assurance reports expired or never read; supplier changes such as new subcontractors or hosting regions accepted without risk assessment; supplier incidents not recorded; review actions raised but never followed up; supplier evaluation limited to quality and delivery with no security criteria.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.