ISO 27001:2022 Annex A Control 5.19

General Guidance on ISO 27001:2022 Annex A 5.19

Compliance with Annex A Control 5.19 involves adhering to what’s known as a ‘topic-specific’ approach to information security in supplier relationships.

An organisation may want suppliers to access and contribute to certain high value information assets (e.g. software code development, accounting payroll information). They would therefore need to have clear agreements of exactly what access they are allowing them, so they can control the security around it.

This is especially important with more and more information management, processing and technology services being outsourced.  That means having a place to show management of the relationship is happening; contracts, contacts, incidents, relationship activity and risk management etc. Where the supplier is also intimately involved in the organisation, but may not have its own certified ISMS, then ensuring the supplier staff are educated and aware of security, trained on your policies etc is also worth demonstrating compliance around.

Topic-specific approaches encourage organisations to create supplier-related policies that are tailored towards individual business functions, rather than adhering to a blanket supplier management policy that applies to any and all third party relationships across an organisation’s commercial operation.

It’s important to note that ISO 27001 Annex A Control 5.19 asks the organisation to implement policies and procedures that not only govern the organisation’s use of supplier resources and cloud platforms, but also form the basis of how they expect their suppliers to conduct themselves prior to and throughout the term of the commercial relationship.

As such, Annex A Control 5.19 can be viewed as the essential qualifying document that dictates how information security governance is handled over the course of a supplier contract.

ISO 27001 Annex A Control 5.19 contains 14 main guidance points to be adhered to:

1) Maintain an accurate record of supplier types (e.g. financial services, ICT hardware, telephony) that have the potential to affect information security integrity.

Compliance – Draft a list of any and all suppliers that your organisation works with, categorise them according to their business function and add categories to said supplier types as and when required.

2) Understand how to vet suppliers, based on the level of risk inherent for their supplier type.

Compliance – Different supplier types will require different due diligence checks. Consider using vetting methods on a supplier-by-supplier basis (e.g. industry references, financial statements, onsite assessments, sector-specific certifications such as Microsoft Partnerships).

3) Identify suppliers that have pre-existing information security controls in place.

Compliance – Ask to see copies of suppliers’ relevant information security governance procedures, in order to evaluate the risk to your own organisation. If they don’t have any, it’s not a good sign.

4) Identify and define the specific areas of your organisation’s ICT infrastructure that your suppliers will be able to either access, monitor or make use of themselves.

Compliance – It’s important to establish from the outset precisely how your suppliers are going to interact with your ICT assets – be they physical or virtual – and what levels of access they’re granted in accordance with their contractual obligations.

5) Define how the suppliers’ own ICT infrastructure can impact upon your own data, and that of your customers.

Compliance – An organisation’s first obligation is to its own set of information security standards. Supplier ICT assets need to be reviewed in accordance with their potential to affect up-time and integrity throughout your organisation.

6) Identify and manage the various information security risks attached to:

a. Supplier use of confidential information or protected assets (e.g. limited to malicious use and/or criminal intent).

b. Faulty supplier hardware or malfunctioning software platform associated with on-premise or cloud based services.

Compliance – Organisations need to be continually mindful of the information security risks associated with catastrophic events, such as nefarious supplier-side user activity or major unforeseen software incidents, and their impact on organisational information security.

7) Monitor information security compliance on a topic specific or supplier type basis.

Compliance – Organisation’s need to appreciate the information security implications inherent within each supplier type, and adjust their monitoring activity to accommodate varying levels of risk.

8) Limit the amount of damage and/or disruption caused through non-compliance.

Compliance – Supplier activity should be monitored in an appropriate manner, and to varying degrees, in accordance with its risk level. Where non-compliance is discovered, either proactively or re-actively, immediate action should be taken.

9) Maintain a robust incident management procedure that addresses a reasonable amount of contingencies.

Compliance – Organisations should understand precisely how to react when faced with a broad range of events relating to the supply of third party products and services, and outline remedial actions that include both the supplier and the organisation.

10) Enact measures that cater to the availability and processing of the supplier’s information, wherever it’s used, thereby ensuring the integrity of the organisation’s own information.

Compliance – Steps should be taken to ensure that supplier systems and data are handled in a way that doesn’t compromise on the availability and security of the organisation’s own systems and information.

11) Draft a thorough training plan that offers guidance on how staff should interact with supplier personnel and information on a supplier-by-supplier basis, or on a type-by-type basis.

Compliance – Training should cover the full spectrum of governance between an organisation and its suppliers, including engagement, granular risk management controls and topic-specific procedures.

12) Understand and manage the level of risk inherent when transferring information and physical and virtual assets between the organisation and their suppliers.

Compliance – Organisations should map out each stage of the transfer process and educate staff as to the risks associated with moving assets and information from one source to another.

13) Ensure that supplier relationships are terminated with information security in mind, including removing access rights and the ability to access organisational information.

Compliance – Your ICT teams should have a clear understanding of how to revoke a supplier’s access to information, including:

• Granular analysis of any associated domain and/or cloud-based accounts.
• Distribution of intellectual property.
• The porting of information between suppliers, or back to your organisation.
• Records management.
• Returning assets to their original owner.
• Adequate disposal of physical and virtual assets, including information.
• Adherence to any contractual requirements, including confidentiality clauses and/or external agreements.

14) Outline precisely how you expect the supplier to conduct themselves regarding physical and virtual security measures.

Compliance – Organisations should set clear expectations from the outset of any commercial relationship, that specify how supplier-side personnel are expected to conduct themselves when interacting with your staff or any relevant assets.

Supplementary Guidance on Annex A 5.19

ISO acknowledges that it’s not always possible to impose a full set of policies on a supplier that meet each and every requirement from the above list as ISO 27001 Annex A Control 5.19 intends, especially when dealing with rigid public sector organisations.

That being said, Annex A Control 5.19 clearly states that organisations should use the above guidance when forming relationships with suppliers, and consider non-adherence on a case-by-case basis.

Where full compliance isn’t achievable, Annex A Control 5.19 gives organisations leeway by recommending “compensating controls” that achieve adequate levels of risk management, based on an organisation’s unique circumstances.

What Are the Changes From ISO 27001:2013?

ISO 27001:2022 Annex A 5.19 replaces ISO 27001:2013 Annex A 15.1.1 (Information security policy for supplier relationships).

ISO 27001:2022 Annex A 5.19 broadly adheres to the same underlying concepts contained in the 2013 control, but does contain several additional guidance areas that are either omitted from ISO 27001:2013 Annex A 5.1.1, or at the very least not covered in as much detail, including:

• The vetting of suppliers based on their supplier type and risk level.
• The need to ensure the integrity of supplier information in order to secure their own data, and ensure business continuity.
• The various steps required when ending a supplier relationship, including the decommissioning of access rights, IP distribution, contractual agreements etc.

ISO 27001:2022 Annex A 5.19 is also explicit in acknowledging the highly variable nature of supplier relationships (based on type, sector and risk level), and gives organisations a certain degree of leeway when considering the possibility of non-compliance of any given guidance point, based on the nature of the relationship (see ‘Supplementary Guidance’ above).

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How Does ISMS.online Help With Supplier Relationships?

ISMS.online has made this control objective very easy by providing evidence that your relationships are carefully elected, managed well in life including being monitored and reviewed. Our easy-to-use Accounts relationships (e.g. supplier) area does just that.  The collaborative projects work spaces is great for important supplier on-boarding, joint initiatives, off-boarding etc all of which the auditor can also view with ease when required.

ISMS.online has also made this control objective easier for your organisation by enabling you to provide evidence that the supplier has formally committed to complying with the requirements and has understood its responsibilities for information security through our Policy Packs. Policy Packs are ideal where the organisation has specific policies & controls it wants supplier staff to follow and take confidence they have read them and committed to comply – beyond the broader agreements between customer and supplier.

Depending on the nature of the change (i.e. for more material changes) there may be a broader requirement to align with A.6.1.5 information Security in Project Management.

Using ISMS.online You Can:

• Quickly implement an Information Security Management System (ISMS).
• Easily manage the documentation of your ISMS.
• Streamline compliance with all relevant standards.
• Manage all aspects of information security, from risk management to security awareness training.
• Effectively communicate throughout your organisation using our built-in communication functionality.

Get in touch today to book a demo.