ISO 27001 Control 5.19: Information Security in Supplier Relationships

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

I can say this with some confidence: on virtually every audit I conduct, somebody has either overlooked supplier management or approached it from the wrong angle. It is almost never missed because people think suppliers do not matter. It is missed because they think they have already dealt with it.

Most small businesses run on other people’s systems. Your email, your files, your accounts package, your CRM, your website host, your IT support company and the developer who built your product are all suppliers, and between them they hold or can reach most of the information your ISMS exists to protect. Control 5.19 is the standard’s way of asking a simple question: do you know which of those relationships carry information security risk, have you checked them, and are you keeping an eye on them?

This page covers what the control actually requires, the two ways I see it misunderstood, how to do it proportionately in a business of twenty people, and what an auditor will ask for. There is a free supplier register further down that holds everything the control expects you to record.

What control 5.19 actually asks for

The requirement is one sentence long. You need defined, implemented processes and procedures for managing the information security risks that come from using suppliers’ products and services. Unpacked into practice, that means:

• Knowing which suppliers are in scope. Not every supplier. The ones whose products or services touch your information, your systems or your ability to operate.
• Deciding what you need from each of them. The security you expect, proportionate to what they hold or can reach.
• Checking before you commit. Some form of due diligence before a supplier gets your data or access to your systems.
• Writing it down. A policy or procedure that says how you do all of this, and a register that shows you have done it.
• Keeping it going. Reviewing suppliers through the life of the relationship, and knowing how to end it safely when it stops.

Notice what the control does not say. It does not say every supplier needs a questionnaire, it does not say you need a procurement function, and it does not require anything from suppliers who never touch your information. The judgement about which suppliers matter and how hard to look at them is yours to make, which is exactly why the register has to show that you made it.

In the 2013 edition this was control A.15.1.1. The 2022 revision moved it to 5.19, split out the ICT supply chain and monitoring into their own controls, and added a new control for cloud services. The intent is unchanged.

Where 5.19 sits among the supplier controls

Five controls in the 2022 edition deal with suppliers, and auditors will test them separately, so it helps to know which one is being asked about.

5.19 is the process; the others are what the process produces. If you have a working 5.19, the contract clauses under 5.20, the questions about your suppliers’ suppliers under 5.21 and the review records under 5.22 all fall out of it naturally. If you do not, each of the others becomes a separate scramble before the audit. That is why this page covers the whole approach, and the pages for 5.20, 5.21, 5.22 and 5.23 go deeper on their own part of it.

The preferred supplier list mistake

Here is the first way this control goes wrong, and it is the one I see most.

The business has a supplier list. Sometimes it is a proper database with contract dates and contact names; sometimes it is a tab in the finance spreadsheet. Either way, somebody points at it and says, with real conviction, that supplier management is covered. They have contracts. They have a list. What more is there?

What they have is a procurement record. It tells you who you pay and what for. It says nothing about whether any of those suppliers can be trusted with your information, because nobody has asked that question. A preferred supplier list is a commercial tool. Control 5.19 is asking about security, and the two can share a spreadsheet without having anything to do with each other.

To be fair, the contract database helps. It tells you who your suppliers are, which is the first step, and it is where the security clauses under 5.20 will live. But a list of suppliers is the input to this control, not the output. The output is a documented view of which suppliers carry information security risk, what you did to satisfy yourself about each of them, and when you last looked.

The test is simple. Pick a supplier that holds your data, your IT support company say, and ask what you know about how they protect it. If the honest answer is “we have a contract with them”, the control is not met yet.

“How am I supposed to send a questionnaire to Microsoft?”

Here is the second way it goes wrong, and it usually follows about ten minutes after the first.

Once people grasp that the control is about checking suppliers, they tend to panic in the other direction. They picture a security questionnaire going to every supplier they have, and then somebody asks the question that stops the room: how exactly are we going to get Microsoft, or Amazon, or Google to fill in our form?

You are not, and you do not need to. The large platform providers publish their assurance precisely so that their customers do not have to ask. Microsoft’s Trust Center and Service Trust Portal, AWS Artifact and Google’s compliance pages all give you their ISO 27001 certificates, their SOC 2 reports and a good deal more besides. Some of it sits behind a customer login or a click-through agreement, but it is there, it is current, and it was produced by an independent auditor with far more access than you will ever get.

Downloading that evidence, reading enough of it to confirm it covers the service you use, and filing it against the supplier in your register counts as checking the supplier out. It is a better check than a questionnaire would be, because the answers were verified by somebody else.

Questionnaires are for the other end of the scale. A twelve-person software house that built and hosts your customer portal has no SOC 2 report. Neither does your IT support company, your payroll bureau or the agency that runs your website. Those are the suppliers where you have to tease the detail out yourself, and a short questionnaire, a conversation, or a visit is how you do it. Keep it proportionate: ten to twenty questions about how they handle your data, who at their end can access it, how they manage their own access and patching, and what they would do if something went wrong. A fifty-page questionnaire sent to a four-person company will either come back blank or come back with the answers they think you want.

So the approach has two speeds. Published assurance for the suppliers who have it. Your own questions for the ones who do not. The register records which you used and where the evidence lives.

Which suppliers are actually in scope

The control is about information security risk, so the question for each supplier is whether they create any. Three tests catch almost everything:

• Do they hold or process our information? Cloud platforms, SaaS applications, outsourced payroll, accountants, printers you send documents to, the shredding company.
• Can they reach our systems or premises? IT support, managed service providers, software developers with access to your code or environments, cleaners and contractors with keys, the alarm company.
• Would we struggle to operate without them? Your internet connection, your hosting, the one supplier your product depends on. This is the availability side of security, and it is the one people forget.

Yes to any of those and the supplier is in scope. No to all three and they are not: the stationery supplier, the coffee company and the landlord’s gardener do not need assessing, and your register should say so rather than leave them out. “Out of scope: holds no information and has no access” is a one-line entry that shows an auditor you considered them, which is a very different thing from never having thought about it.

For most twenty-person businesses this produces somewhere between eight and twenty suppliers that matter. That is a manageable number, and it is the number the rest of this page is written for.

Proportionate due diligence for a small business

The word the standard uses is risk, and risk is what should set how hard you look. The practical way to do that is to tier the suppliers in scope. Three tiers is enough:

Tier 1: they hold our information or can reach our systems

This is where the effort goes. Before committing: evidence of certification or published assurance where it exists, a short questionnaire where it does not, and a contract or terms containing the security obligations you need (that is control 5.20). Then an annual review: confirm the certificate is still current, note any incidents or changes, and record how they performed against what they committed to. Your cloud platforms, IT support, developers, payroll and anything holding client or personal data belong here.

Tier 2: we depend on them, but they hold nothing sensitive

Your connectivity provider, the hosting behind your marketing site, a critical component supplier. The question here is availability and continuity rather than confidentiality. Record what they have committed to, check at renewal that it is still true, and make sure your business continuity thinking under control 5.30 covers losing them.

Tier 3: on the register, out of scope

Everyone else. One line each, with the reason they are out of scope. Review the list once a year to catch the supplier who started as a stationery company and now hosts your intranet.

Two points worth making. First, the tiering is a risk decision, so document the criteria once in your supplier procedure and apply them consistently; an auditor will accept almost any sensible scheme if it is written down and followed. Second, the tier can change. A supplier who gains access to your systems mid-contract moves up a tier, and the review should notice.

Performance against what they committed to

Here is the part that even the organisations with a decent register tend to miss. Checking a supplier out before you sign is half of the control. The other half is knowing how they are actually performing against what they promised, and that has to be written down somewhere.

People hear “performance” and assume it is a commercial matter, nothing to do with security. It is not. Think about what a typical service level agreement actually contains: availability targets, response times, backup and recovery commitments, incident notification timescales. Availability is one third of the confidentiality, integrity and availability model that the whole of information security rests on. A supplier who promised 99.9% uptime and delivered three outages last quarter has a security performance problem, whether or not anyone at your end thought of it that way.

So, for each Tier 1 and Tier 2 supplier, hold a few lines of notes on how they have done: outages and how they were handled, any security incidents they told you about (and any they should have told you about and did not), how quickly they responded when you needed them, and whether anything about the service changed. This does not need to be elaborate. A dated paragraph per supplier per review is enough, and it is precisely what control 5.22 is looking for when the auditor moves on to it.

The register below has a column for exactly this, because in my experience it is the column that stays empty unless the template insists on it.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call

What auditors will look for

As a Lead Auditor, this is broadly the order I would work through 5.19.

1. Your supplier procedure. Does a written process exist that says which suppliers are in scope, how they are assessed and how often they are reviewed? If it exists, I will then check whether the register looks like it was produced by following it.
2. The register itself. I am looking for a security view, not a procurement list. If every supplier has the same entry and none of them has an assessment attached, that tells me the question was never asked.
3. One Tier 1 supplier, traced. Pick the supplier holding your most sensitive data. Show me what you checked before committing, where the evidence is, what the contract says about security, and when you last reviewed them. For a platform provider, I expect to see the downloaded certificate or report, not a note saying “they are Microsoft”.
4. One small supplier. Your IT support company or your developer. These are the ones with no published assurance, so I want to see the questions you asked and the answers you got.
5. Performance records. How has your main supplier actually done against what they committed to, and where is that written down?
6. A supplier who left. When a supplier relationship ended, how did you get your data back or confirm it was destroyed, and how was their access removed?

Common issues

• A procurement list presented as supplier security management. Contracts and contact names, no assessment, no risk view.
• No register at all, because “we only use Microsoft”, which is never true once you count the IT support company, the accountant and the website agency.
• Questionnaires sent to everyone regardless of size, with the results filed unread. Volume mistaken for diligence.
• Platform providers marked as “not assessed” because nobody realised the assurance was published and available.
• The IT support company holding administrative access to everything, with nothing on file about how they manage their own staff, access or security.
• Performance never recorded. A supplier with repeated outages or a reportable incident, and no note of it anywhere in the ISMS.
• The register built for the audit and never looked at again. The review date column is the tell.
• No thought given to exit. The supplier changes or is dropped and nobody can say what happened to the data they held.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• Name the supplier that holds your most sensitive information. What did you check about them before you committed, and where is the evidence?
• Does your IT support company, or whoever has administrative access to your systems, have anything on file beyond a contract?
• For your main cloud platform, could you produce their ISO 27001 certificate or SOC 2 report within ten minutes?
• Which suppliers did you deliberately decide were out of scope, and where is that decision recorded?
• How has your most important supplier actually performed in the last year, and is that written down anywhere?

The first and last are the ones to sit with. Most organisations can produce a contract. Far fewer can produce an assessment, and fewer still can show what happened after it.

A worked example

The figures below are typical rather than drawn from a single engagement. This is a composite of what a first proper supplier review turns up in a business of this size.

A 20-person consultancy on Microsoft 365, with a SaaS CRM, a cloud accounting package, an outsourced IT support company, an outsourced payroll bureau and a web agency hosting the company site. They have a supplier spreadsheet kept by the office manager with 43 entries, including the window cleaner.

What the review found

• Of the 43 suppliers, 11 held information or had access to systems, 3 were critical to operating, and 29 were out of scope. Nobody had previously drawn that distinction.
• The IT support company held global administrator rights to Microsoft 365 and had a contract covering response times and nothing about security. Nobody had ever asked how they vetted their own engineers or managed their own access.
• Microsoft and the CRM provider both published ISO 27001 certificates and SOC 2 reports. Nothing had been downloaded or filed, and the register said “not assessed” against both.
• The payroll bureau held every employee’s bank details and had been chosen on price four years earlier. There was no record of any security conversation.
• The web agency had suffered a hosting outage of around a day the previous year. It was remembered, but not recorded anywhere.

What changed

• A one-page supplier procedure setting out the three scope tests and the three tiers, and the register rebuilt around it: 11 lines in Tier 1, 3 in Tier 2, 29 marked out of scope with a reason.
• Published assurance downloaded and filed for the platform providers, with a note of which service each report covered and a reminder set for the annual refresh.
• A fifteen-question questionnaire sent to the IT support company, the payroll bureau and the web agency. The IT support company’s answers led to a contract addendum on staff vetting, access management and incident notification.
• A performance note added against each Tier 1 and Tier 2 supplier, starting with the web agency outage, and a date set for the first annual review.

About a day and a half of effort in total, most of it on the questionnaires. The next review will take a morning. The difference between 43 lines and 14 lines that actually mean something is the whole point.

How control 5.19 links to other clauses and controls

• Control 5.20, Addressing information security within supplier agreements. The contract clauses. Your 5.19 assessment decides what you need from a supplier; 5.20 is where it gets written into the agreement.
• Control 5.21, Managing information security in the ICT supply chain. Your suppliers’ suppliers. For most SMEs this means knowing that your SaaS provider runs on AWS or Azure, and that their assurance covers it.
• Control 5.22, Monitoring, review and change management of supplier services. The ongoing half of 5.19. The performance notes and annual reviews described above are the evidence this control asks for.
• Control 5.23, Information security for use of cloud services. New in 2022. The same discipline applied to acquiring, using and leaving cloud services, which for most small businesses is most of the suppliers in Tier 1.
• Control 5.9, Inventory of information and other associated assets. Your asset register tells you which information sits with which supplier. If the two registers disagree, one of them is wrong.
• Control 5.30, ICT readiness for business continuity. Tier 2 lives here. Losing a critical supplier is a continuity scenario and should appear in your planning.
• Control 5.34, Privacy and protection of PII. Where a supplier processes personal data on your behalf, the GDPR processor requirements run alongside this control, and the assessment should cover both.
• Clause 6.1, Actions to address risks and opportunities. Supplier risks belong in the risk assessment, not just the supplier register. A supplier holding your crown jewels with no assurance on file is a risk with a name.

Frequently asked questions

Do I need to assess every supplier?

No. The control is about suppliers whose products or services create information security risk. Suppliers who hold none of your information, have no access to your systems and are not critical to operating can be recorded as out of scope with a one-line reason. Recording that decision matters; simply leaving them off the register does not show you considered them.

How do I assess a large cloud provider like Microsoft or AWS?

Use the assurance they publish. Their ISO 27001 certificates, SOC 2 reports and compliance documentation are available through their trust portals, sometimes behind a customer login or click-through agreement. Download the evidence, check it covers the services you actually use, file it against the supplier in your register and refresh it annually. You do not send them a questionnaire, and an auditor would not expect you to.

Is a contract enough to satisfy control 5.19?

No. A contract is evidence for control 5.20, and only if it contains security obligations. Control 5.19 asks whether you assessed the supplier’s security and are managing the risk, which a contract on its own does not show. Many organisations have good contracts and no assessments; that is the most common gap on this control.

How often should suppliers be reviewed?

The standard does not set an interval. Annually for suppliers who hold your information or can reach your systems is defensible for most small businesses, with an additional review whenever the service changes, the supplier reports an incident, or the contract comes up for renewal. Record each review, including the ones where nothing had changed.

What should a supplier security questionnaire contain?

Keep it short and specific to what the supplier does for you. Ten to twenty questions covering where your data is held, who at the supplier can access it, how they control and review that access, how they patch and back up, whether they hold any certification, how they would notify you of an incident, and what happens to your data when the relationship ends. Long generic questionnaires sent to small suppliers produce poor answers and are rarely read on return.

Does control 5.19 cover contractors and freelancers?

Yes, where they have access to your information or systems. A freelance developer with access to your code is a supplier for this purpose, and the same questions apply: what you checked, what they agreed to, and how their access is managed and removed. Many organisations handle individuals under their HR and access controls instead, which is fine as long as somebody is covering it and the register says where.