Your suppliers carry part of your risk. Annex A asks you to manage that share on purpose.

1. 5.19
   Information security in supplier relationshipsDecide how you choose and manage suppliers so their access to your information does not become your weakest point.
2. 5.20
   Addressing information security within supplier agreementsAgree the security duties of each supplier in writing, sized to what the supplier can reach.
3. 5.21
   Managing information security in the ICT supply chainLook past the supplier to the software, hardware and sub-suppliers that sit behind it.
4. 5.22
   Monitoring, review and change management of supplier servicesCheck over time that suppliers still meet what they agreed, and handle changes to their service.

Read together, the controls describe a lifecycle rather than a checklist. A supplier policy sets the rules. Due diligence applies them before purchase. The contract fixes them. Monitoring proves they still hold. An auditor follows one supplier through all four stages and expects each stage to leave a record.

The full list of organizational controls and how they group is on the Annex A organizational controls page. Here we stay with these four.

Treating every vendor the same wastes effort on the office coffee contract and starves the review of the provider that hosts customer data. A tier set by what a supplier can touch keeps the work proportionate, and it is the first thing an auditor uses to judge whether your process is sensible.

Write the tier rules into the supplier policy so the decision is repeatable. A supplier can move up a tier when you start sending it more data. That move should trigger the checks of the new tier.

The questions below are a starting set for critical and high-tier suppliers. Each one is meant to produce an answer you can check, not a yes you have to take on trust.

1. Which of our data will you store or see, in which countries, and on whose infrastructure?
2. What independent assurance can you share, and does its scope cover the service we are buying?
3. Which of your own suppliers will touch our data, and how will you tell us when that list changes?
4. How do your staff get access to customer environments, and how is that access approved and removed?
5. How soon will you tell us about an incident that affects our data, and through which contact?
6. How do you back up the service, and when did you last test a restore?
7. How will we get our data back, in what format, and how will you delete it when we leave?
8. Who on your side owns security, and how do we reach them outside a sales conversation?

• Scope of information. Which information the supplier may handle, and what it may and may not do with it.
• Minimum safeguards. The baseline controls you expect, or a reference to a standard or report the supplier will keep current.
• Incident notice. A duty to tell you about incidents affecting your information within an agreed window, through named contacts.
• Sub-suppliers. Your right to know about, and object to or approve, sub-suppliers who will touch your information, with the same duties passed down.
• Right to assurance. Your right to receive assurance reports, or to audit or assess, in proportion to the tier.
• Change notice. Advance notice of changes to the service, its location or its security that could affect you.
• Return and deletion. How data comes back at the end, and written confirmation that copies are deleted.
• Confidentiality and staff. Confidentiality duties that bind the supplier's people, and screening where the role warrants it.

Large suppliers often refuse to change their paper. That is acceptable. Record what their standard terms already cover, note the gaps, and decide whether to accept the residual risk. The risk decision is the evidence, not a negotiated clause.

• The supplier policy and the tier rules it sets
• The supplier register, complete enough that the auditor's own list of paid vendors finds no surprise
• For a sampled critical supplier: the due-diligence answers, the assurance report you reviewed and your notes on it
• The signed agreement, with the security terms or the recorded risk decision where terms were missing
• Records of the last review, including any changes the supplier announced and what you did about them

• Register built from memory. The auditor compares it with accounts payable. Missing vendors suggest the process does not run.
• Report filed, never read. A supplier's SOC 2 sitting in a folder, with no note of scope or exceptions, shows collection rather than review.
• No exit thought. Critical suppliers with no plan for getting data back leave 5.20 half done.
• Monitoring only at onboarding. 5.22 is about the life of the contract. A single check at the start does not meet it.
• Ignoring the fourth party. The supplier's own hosting or subprocessors sit inside 5.21 and need at least a recorded look.

Sources: ISO/IEC 27001:2022 Annex A control names 5.19 to 5.22; ISO/IEC 27002:2022 as background on control purpose (not quoted); the ISO/IEC 27036 series on information security for supplier relationships, including its part on ICT supply chain security. Tiers, questions and clauses are our own illustration.