ISO 27001:2022 Annex A 5.19 Checklist Guide •

ISO 27001:2022 Annex A 5.19 Checklist Guide

See how ISMS.online can help your business

See it in action
By Max Edwards | Updated 15 August 2024

Utilising a checklist for A.5.19 Information Security in Supplier Relationships ensures systematic compliance, mitigates risks, and strengthens supplier security management. This approach enhances accountability, efficiency, and alignment with ISO 27001:2022 standards.

Jump to topic

ISO 27001 A.5.19 Information Security in Supplier Relationships Checklist

This control ensures information security throughout the lifecycle of supplier relationships. It includes selection, management, and review of suppliers accessing the organisation’s information assets. Comprehensive security measures in supplier relationships mitigate risks, protect data, and ensure compliance with regulations and standards.

Implementing Annex A 5.19 from ISO 27001:2022 involves managing and securing relationships with suppliers who handle the organisation’s information. This control is crucial to address risks posed by third-party vendors and ensure they adhere to the same security standards as the organisation.

This guide provides a detailed approach to implementing this control, highlights common challenges, suggests solutions, and explains how ISMS.online features can aid in demonstrating compliance.


Get an 81% headstart

We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.

Book a demo

Why Should You Comply With Annex A.5.19? Key Aspects and Common Challenges

1. Supplier Assessment:

Risk Assessment:

Challenge: Obtaining accurate and comprehensive information about the supplier’s security posture and history of security incidents.

Solution: Conduct thorough due diligence using standardised assessment templates and document findings in the Risk Bank. Utilise the Dynamic Risk Map to visualise and manage risks.

Compliance Checklist:

Document all supplier security assessments in the Risk Bank.

Utilise standardised assessment templates for consistency.

Review historical security incidents of suppliers.

Update risk profiles based on assessment findings.

Associated ISO Clauses: Identifying and assessing risks (Clause 6.1.2), Documenting and maintaining information (Clause 7.5).

Due Diligence:

Challenge: Verifying supplier compliance with security standards and regulations can be time-consuming and complex.

Solution: Leverage assessment templates and compliance management features to streamline the due diligence process and ensure thorough evaluation.

Compliance Checklist:

Review supplier certifications (e.g., ISO 27001).

Conduct security audits using standardised templates.

Assess supplier security policies and procedures.

Document findings and compliance status.

Associated ISO Clauses: Conducting internal audits (Clause 9.2), Ensuring competence and awareness (Clause 7.2).

2. Security Requirements:

Contractual Agreements:

Challenge: Ensuring that security requirements are clearly defined and legally binding in contracts and SLAs.

Solution: Use policy templates to create robust security clauses and incorporate them into supplier agreements. Utilise version control to maintain up-to-date documents.

Compliance Checklist:

Define security requirements in contracts and SLAs.

Use policy templates for security clauses.

Ensure contracts include legally binding security terms.

Maintain version control for all agreements.

Associated ISO Clauses: Establishing and maintaining documented information (Clause 7.5), Determining and providing necessary resources (Clause 7.1).

Security Policies:

Challenge: Aligning supplier security policies with the organisation’s security objectives and ensuring adherence.

Solution: Regularly review and update supplier policies using policy management tools. Ensure clear communication of these policies to suppliers through collaboration tools.

Compliance Checklist:

Review supplier security policies regularly.

Update policies to align with organisational objectives.

Communicate updated policies to suppliers.

Track acknowledgement of policy receipt by suppliers.

Associated ISO Clauses: Establishing security policies (Clause 5.2), Communicating relevant policies to interested parties (Clause 7.4).

3. Ongoing Management:

Monitoring and Review:

Challenge: Continuously monitoring supplier compliance and performance can be resource-intensive.

Solution: Implement performance tracking and monitoring features to automate and streamline the review process. Schedule regular assessments and audits.

Compliance Checklist:

Schedule regular supplier performance assessments.

Use performance tracking tools to monitor compliance.

Conduct periodic security audits.

Document and review audit findings.

Associated ISO Clauses: Monitoring and measuring performance (Clause 9.1), Conducting management reviews (Clause 9.3).

Incident Management:

Challenge: Coordinating incident response between the organisation and suppliers, especially in a timely manner.

Solution: Use the Incident Tracker and workflow automation to ensure efficient incident reporting, response coordination, and resolution.

Compliance Checklist:

Establish procedures for incident reporting and response.

Track incidents using the Incident Tracker.

Coordinate responses with suppliers using automated workflows.

Document incident responses and resolutions.

Associated ISO Clauses: Managing and reporting incidents (Clause 6.1.3), Continual improvement through corrective actions (Clause 10.1).

4. Supplier Termination:

Exit Strategies:

Challenge: Ensuring the secure return or destruction of the organisation’s data and revoking access to information systems upon termination of the supplier relationship.

Solution: Develop clear exit strategies and protocols using document management features. Track and verify the completion of all termination procedures.

Compliance Checklist:

Develop exit strategies for supplier termination.

Ensure secure return or destruction of data.

Revoke access to information systems.

Document and verify completion of termination procedures.

Associated ISO Clauses: Maintaining security during changes (Clause 8.3), Ensuring secure disposal or return of assets (Clause 8.1).

5. Communication and Collaboration:

Information Sharing:

Challenge: Maintaining clear and secure communication channels with suppliers to facilitate information sharing related to security threats and vulnerabilities.

Solution: Utilise collaboration tools and alert systems to ensure timely and secure communication with suppliers.

Compliance Checklist:

Establish secure communication channels with suppliers.

Use collaboration tools for information sharing.

Implement alert systems for timely communication.

Track communication and responses.

Associated ISO Clauses: Ensuring effective internal and external communication (Clause 7.4), Documenting and maintaining communication records (Clause 7.5).

Training and Awareness:

Challenge: Ensuring that suppliers understand and adhere to the organisation’s security requirements and their role in maintaining security.

Solution: Provide training and awareness programmes through training modules. Track participation and comprehension to ensure effectiveness.

Compliance Checklist:

Develop training programmes for suppliers.

Deliver training using training modules.

Track training participation and completion.

Assess comprehension and adherence to security requirements.

Associated ISO Clauses: Ensuring awareness and training (Clause 7.2), Communicating roles and responsibilities (Clause 5.3).


Compliance doesn't have to be complicated.

We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.

Book a demo

ISMS.online Features for Demonstrating Compliance with A.5.19

1. Supplier Management:

Supplier Database: Maintain a comprehensive database of all suppliers, including their contact information, risk assessments, and performance metrics.

Assessment Templates: Utilise customisable templates for assessing supplier security posture, conducting due diligence, and verifying compliance with security requirements.

Performance Tracking: Monitor supplier performance against agreed security requirements and SLAs, ensuring continuous compliance and prompt identification of any issues.

Compliance Checklist:

Maintain up-to-date supplier database.

Use assessment templates for supplier evaluations.

Track supplier performance metrics.

Document compliance status and findings.

2. Risk Management:

Risk Bank: Use the Risk Bank to document and categorise risks associated with supplier relationships, ensuring a structured approach to risk identification and mitigation.

Dynamic Risk Map: Visualise and manage risks related to suppliers, facilitating ongoing risk assessment and treatment planning.

Risk Monitoring: Continuously monitor risks associated with suppliers and update risk profiles based on changes in their security posture or incidents.

Compliance Checklist:

Document risks in the Risk Bank.

Use the Dynamic Risk Map for visualisation.

Monitor and update risk profiles regularly.

Implement risk treatment plans.

3. Policy Management:

Policy Templates: Access a library of policy templates to define and communicate security requirements for suppliers, including data protection, access control, and incident management.

Version Control: Ensure all policies related to supplier management are up-to-date and accessible, with version control and audit trails for compliance verification.

Compliance Checklist:

Utilise policy templates for consistency.

Maintain version control for all policies.

Ensure policies are accessible to relevant stakeholders.

Track policy updates and audit trails.

4. Incident Management:

Incident Tracker: Track and manage security incidents involving suppliers, ensuring timely reporting, response coordination, and resolution.

Workflow Automation: Automate incident response workflows to streamline communication and actions between the organisation and suppliers.

Reporting: Generate detailed reports on incidents involving suppliers to support continuous improvement and compliance audits.

Compliance Checklist:

Track incidents using the Incident Tracker.

Automate incident response workflows.

Document incident responses and outcomes.

Generate incident reports for audits.

5. Compliance Management:

Regs Database: Access a comprehensive database of regulatory requirements to ensure supplier contracts and agreements comply with relevant security standards.

Alert System: Receive alerts on changes in regulations or standards that may impact supplier management, ensuring proactive compliance.

Reporting and Documentation: Maintain detailed documentation of supplier assessments, risk management activities, incident responses, and compliance efforts for audit purposes.

Compliance Checklist:

Access and review regulatory requirements.

Implement alerts for regulatory changes.

Document compliance activities thoroughly.

Generate reports for compliance audits.

Implementation Tips

  • Develop a Comprehensive Supplier Management Policy: Outline the criteria for selecting, assessing, and managing suppliers, ensuring it aligns with organisational security objectives.
  • Use Standardised Tools and Templates: Utilise questionnaires, assessment tools, and policy templates to streamline processes and maintain consistency.
  • Integrate Security Performance Metrics: Regularly review and incorporate security performance metrics into supplier evaluations to measure and track compliance.
  • Foster Collaborative Relationships: Promote a culture of security collaboration and continuous improvement with suppliers to ensure mutual understanding and adherence to security requirements.

By implementing these controls and leveraging ISMS.online features, organisations can overcome common challenges and ensure that their suppliers are effectively managing information security risks, thereby protecting the organisation’s information assets throughout the supply chain.


Manage all your compliance in one place

ISMS.online supports over 100 standards
and regulations, giving you a single
platform for all your compliance needs.

Book a demo

Every Annex A Control Checklist Table

ISO 27001 Annex A.5 Control Checklist Table

ISO 27001 Control NumberISO 27001 Control Checklist
Annex A.5.1Policies for Information Security Checklist
Annex A.5.2Information Security Roles and Responsibilities Checklist
Annex A.5.3Segregation of Duties Checklist
Annex A.5.4Management Responsibilities Checklist
Annex A.5.5Contact With Authorities Checklist
Annex A.5.6Contact With Special Interest Groups Checklist
Annex A.5.7Threat Intelligence Checklist
Annex A.5.8Information Security in Project Management Checklist
Annex A.5.9Inventory of Information and Other Associated Assets Checklist
Annex A.5.10Acceptable Use of Information and Other Associated Assets Checklist
Annex A.5.11Return of Assets Checklist
Annex A.5.12Classification of Information Checklist
Annex A.5.13Labelling of Information Checklist
Annex A.5.14Information Transfer Checklist
Annex A.5.15Access Control Checklist
Annex A.5.16Identity Management Checklist
Annex A.5.17Authentication Information Checklist
Annex A.5.18Access Rights Checklist
Annex A.5.19Information Security in Supplier Relationships Checklist
Annex A.5.20Addressing Information Security Within Supplier Agreements Checklist
Annex A.5.21Managing Information Security in the ICT Supply Chain Checklist
Annex A.5.22Monitoring, Review and Change Management of Supplier Services Checklist
Annex A.5.23Information Security for Use of Cloud Services Checklist
Annex A.5.24Information Security Incident Management Planning and Preparation Checklist
Annex A.5.25Assessment and Decision on Information Security Events Checklist
Annex A.5.26Response to Information Security Incidents Checklist
Annex A.5.27Learning From Information Security Incidents Checklist
Annex A.5.28Collection of Evidence Checklist
Annex A.5.29Information Security During Disruption Checklist
Annex A.5.30ICT Readiness for Business Continuity Checklist
Annex A.5.31Legal, Statutory, Regulatory and Contractual Requirements Checklist
Annex A.5.32Intellectual Property Rights Checklist
Annex A.5.33Protection of Records Checklist
Annex A.5.34Privacy and Protection of PII Checklist
Annex A.5.35Independent Review of Information Security Checklist
Annex A.5.36Compliance With Policies, Rules, and Standards for Information Security Checklist
Annex A.5.37Documented Operating Procedures Checklist


ISO 27001 Annex A.6 Control Checklist Table

ISO 27001 Control NumberISO 27001 Control Checklist
Annex A.6.1Screening Checklist
Annex A.6.2Terms and Conditions of Employment Checklist
Annex A.6.3Information Security Awareness, Education and Training Checklist
Annex A.6.4Disciplinary Process Checklist
Annex A.6.5Responsibilities After Termination or Change of Employment Checklist
Annex A.6.6Confidentiality or Non-Disclosure Agreements Checklist
Annex A.6.7Remote Working Checklist
Annex A.6.8Information Security Event Reporting Checklist


ISO 27001 Annex A.7 Control Checklist Table

ISO 27001 Control NumberISO 27001 Control Checklist
Annex A.7.1Physical Security Perimeters Checklist
Annex A.7.2Physical Entry Checklist
Annex A.7.3Securing Offices, Rooms, and Facilities Checklist
Annex A.7.4Physical Security Monitoring Checklist
Annex A.7.5Protecting Against Physical and Environmental Threats Checklist
Annex A.7.6Working in Secure Areas Checklist
Annex A.7.7Clear Desk and Clear Screen Checklist
Annex A.7.8Equipment Siting and Protection Checklist
Annex A.7.9Security of Assets Off-Premises Checklist
Annex A.7.10Storage Media Checklist
Annex A.7.11Supporting Utilities Checklist
Annex A.7.12Cabling Security Checklist
Annex A.7.13Equipment Maintenance Checklist
Annex A.7.14Secure Disposal or Re-Use of Equipment Checklist


ISO 27001 Annex A.8 Control Checklist Table

ISO 27001 Control NumberISO 27001 Control Checklist
Annex A.8.1User Endpoint Devices Checklist
Annex A.8.2Privileged Access Rights Checklist
Annex A.8.3Information Access Restriction Checklist
Annex A.8.4Access to Source Code Checklist
Annex A.8.5Secure Authentication Checklist
Annex A.8.6Capacity Management Checklist
Annex A.8.7Protection Against Malware Checklist
Annex A.8.8Management of Technical Vulnerabilities Checklist
Annex A.8.9Configuration Management Checklist
Annex A.8.10Information Deletion Checklist
Annex A.8.11Data Masking Checklist
Annex A.8.12Data Leakage Prevention Checklist
Annex A.8.13Information Backup Checklist
Annex A.8.14Redundancy of Information Processing Facilities Checklist
Annex A.8.15Logging Checklist
Annex A.8.16Monitoring Activities Checklist
Annex A.8.17Clock Synchronisation Checklist
Annex A.8.18Use of Privileged Utility Programs Checklist
Annex A.8.19Installation of Software on Operational Systems Checklist
Annex A.8.20Networks Security Checklist
Annex A.8.21Security of Network Services Checklist
Annex A.8.22Segregation of Networks Checklist
Annex A.8.23Web Filtering Checklist
Annex A.8.24Use of Cryptography Checklist
Annex A.8.25Secure Development Life Cycle Checklist
Annex A.8.26Application Security Requirements Checklist
Annex A.8.27Secure System Architecture and Engineering Principles Checklist
Annex A.8.28Secure Coding Checklist
Annex A.8.29Security Testing in Development and Acceptance Checklist
Annex A.8.30Outsourced Development Checklist
Annex A.8.31Separation of Development, Test and Production Environments Checklist
Annex A.8.32Change Management Checklist
Annex A.8.33Test Information Checklist
Annex A.8.34Protection of Information Systems During Audit Testing Checklist


How ISMS.online Help With A.5.19

Ensuring robust information security in supplier relationships is critical to protecting your organisation’s sensitive data and maintaining compliance with ISO 27001:2022. By leveraging the comprehensive features of ISMS.online, you can streamline the implementation of Annex A 5.19 controls, overcome common challenges, and achieve seamless compliance.

Ready to enhance your supplier management and fortify your information security framework? Contact ISMS.online today to learn how our platform can support your compliance journey and book a personalised demo.

Take the next step towards stronger security and compliance.

complete compliance solution

Want to explore?
Start your free trial.

Sign up for your free trial today and get hands on with all the compliance features that ISMS.online has to offer

Find out more

Explore ISMS.online's platform with a self-guided tour - Start Now