ISO 27001 Control 5.21: Managing Information Security in the ICT Supply Chain

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

Very rarely does anyone I audit demonstrate real awareness of their supply chain. They know their suppliers, more or less. They almost never know their suppliers’ suppliers, and that is where control 5.21 lives.

Think about what sits behind a typical small business’s systems. The CRM runs on AWS. The IT support company manages your laptops through a remote monitoring tool hosted by somebody else entirely. The payroll bureau uses a print and mailing house. The clever AI note-taker your sales team adopted sends recordings to a model provider you have never heard of. Each of those is a link in a chain that ends with your information, and each is a place where something can go wrong without you ever having signed anything with the party responsible.

This page covers what the control asks for, how to find out who is really handling your data, a story about what happens when a sub-supplier decides your data is theirs to use, and how to manage all of this proportionately in a business that does not have a procurement department.

What control 5.21 actually asks for

The requirement is that processes and procedures are defined and implemented to manage the information security risks associated with the ICT products and services supply chain. In practice, for a small business, that means:

• Knowing who your key suppliers rely on, at least for the suppliers that hold your data or run your critical systems.
• Knowing where your data actually goes, including to sub-processors, hosting providers and support teams.
• Making sure your requirements flow down. What you agreed with your supplier should bind the parties they pass your data to.
• Being told about changes, so a new sub-processor or a move to a different hosting provider does not happen silently.
• Buying technology from sources you can trust, and keeping it supported and patched.

The ICT product side matters too: hardware and software with a known origin, bought from reputable sources and kept within support. If you develop software, it extends to knowing the components and libraries your product depends on. For most SMEs, though, the services side is where the real risk sits, so that is where this page spends most of its time.

In the 2013 edition this was control A.15.1.3. The intent is unchanged.

Where 5.21 sits among the supplier controls

Five controls in the 2022 edition deal with suppliers. 5.21 is the one that looks past your direct suppliers to the chain behind them.

5.21 extends your view one step further down the chain. Your supplier assessment looks at the supplier in front of you. Your agreement is where you require them to tell you about sub-processors and pass your requirements on. 5.21 is where you actually know who those sub-processors are, and whether you are comfortable with them.

Where is your data really?

Here is the scenario I come back to. Your business uses a small local IT company. Call it Bob’s IT. Bob is good, responsive and reasonably priced, and you trust him with administrative access to everything you own.

Do you know where Bob keeps your data? His ticketing system holds your passwords in some notes fields, your network diagrams, screenshots of your systems. His remote management tool can reach every one of your laptops. His backup service holds copies of your files. Each of those is a third-party platform, and each is hosted somewhere. Quite possibly somewhere you would be very unhappy about if you knew.

None of this is unusual, and none of it is Bob’s fault. It is simply that nobody asked. The way to find out is straightforward:

• Read the contract, and the published terms of the platforms your supplier uses where you can. This is where control 5.20 does the heavy lifting. A good agreement requires the supplier to disclose its sub-processors and tell you when they change.
• Ask. For your Tier 1 suppliers, one of the questions in your supplier questionnaire should be: which other companies handle our data or have access to our systems on your behalf, and where are they based?
• Check published sub-processor lists. Most SaaS providers of any size publish one. Read it once, note anything that conflicts with your own commitments, and subscribe to change notifications if they offer them.
• Understand the implications, not just the names. A US-hosted remote management tool matters if your largest customer has told you their data must not leave the UK.

Then document what you find. Record the key sub-suppliers, where they are, and any concerns against the supplier’s entry in your register. That one step is what turns a vague awareness into evidence an auditor can see.

A Cautionary Tale

I can only tell this one in outline, but the outline is the point.

A company was processing highly sensitive data on behalf of government clients. The processing itself was done by a sub-supplier further down the chain. Somewhere along the way, the sub-supplier decided that because it could anonymise the data, it could also sell it on as metadata. Anonymised, so no harm done. That was the reasoning.

When the governments found out, they went ballistic. The contract was terminated, and the reputational damage spread well beyond the party that had actually done it.

Three lessons from that, and they apply to a twenty-person business just as much as to a government contractor:

• Your data can be misused by someone you have never met. The clients had no contract with the sub-supplier. They had a contract with the company in front of them, and that was who paid the price.
• “Anonymised” does not mean “permitted”. The question is not whether the data can be identified. It is whether anyone agreed it could be used for that purpose. Restrictions on use have to be written down and flowed down the chain.
• Flow-down clauses are not paperwork. If your agreement with a supplier restricts what they can do with your data, it needs to require them to impose the same restrictions on anyone they pass it to. Otherwise the restriction stops one link short of where it is needed.

Managing the chain proportionately

None of this means mapping every supplier’s entire supply chain. For a small business, a proportionate approach looks like this:

For Tier 1 suppliers

Know their key sub-processors and where they are based. Require, through the agreement, that they tell you about changes and pass on your security requirements. Record the sub-suppliers against the supplier in your register, with any concerns and what you decided about them.

For the platforms everything runs on

You do not need to assess AWS on behalf of your CRM provider. You do need to know that your CRM runs on AWS, in which region, and that the CRM provider’s own assurance covers that hosting. Their SOC 2 report or ISO 27001 scope will usually say so.

For technology products

Buy hardware and software from reputable sources, keep it within vendor support, and patch it. If you build software, know your dependencies: open source libraries are a supply chain too, and an abandoned or compromised library in your product is exactly the risk this control describes.

For change

Make “any new sub-processors or changes in where our data is processed?” a standing question in every supplier review under control 5.22. That is how a silent change gets caught.

The supplier register from control 5.19 already has the space for this: use the Notes column, or add a column for key sub-suppliers and data location, and record what you found.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call

What auditors will look for

As a Lead Auditor, this is broadly how I would work through 5.21.

1. One Tier 1 supplier. Who do they rely on to deliver your service, and where is your data actually processed? I am looking for a recorded answer, not a guess.
2. Your IT support provider. What tools do they use to manage your systems, and where are those hosted? This is the one that most often draws a blank.
3. Flow-down. Does your agreement require the supplier to pass your security requirements on to their sub-processors, and to tell you about changes?
4. A change. When did a supplier last add a sub-processor or move your data, and how did you find out?
5. Technology products. Where do you buy hardware and software, and how do you know what you have is genuine and supported?
6. If you develop software, how you track and update the third-party components in your product.

Common issues

• No awareness of sub-suppliers at all. The supplier register stops at the direct supplier.
• IT support providers whose own tools and hosting have never been looked at, despite holding the keys to everything.
• Data processed outside the UK or EU by a sub-processor, in conflict with the business’s own customer commitments.
• Agreements with no flow-down of security or data use restrictions.
• Sub-processor change notifications going to an inbox nobody reads, or to someone who left.
• AI tools adopted by individual teams that send company data to model providers nobody has assessed.
• Unsupported or grey-market hardware and software, bought because it was cheaper.
• In software businesses, third-party libraries that nobody owns and nobody updates.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• For your most important SaaS supplier, which cloud platform does it run on, and in which region?
• What tools does your IT support provider use to manage your systems, and where are they hosted?
• Does any agreement you hold restrict what a supplier’s sub-processors may do with your data?
• When a supplier changes its sub-processors, who in your business is told?
• Which of your teams is using an AI tool that sends company information somewhere you have not checked?

The last one is the newest blind spot, and in my experience it is growing faster than any other.

A worked example

The figures below are typical rather than drawn from a single engagement. This is a composite of what a first look at the supply chain turns up in a business of this size.

A 25-person marketing agency handling customer data for retail clients, two of whom require UK-only data processing. It uses Microsoft 365, a SaaS CRM, an outsourced IT support company and an email marketing platform.

What the review found

• The CRM ran on AWS in a UK region, and its SOC 2 report covered the hosting. No issue, but nobody had previously known.
• The email marketing platform’s published sub-processor list included analytics and delivery providers in the United States. Client customer lists were going there.
• The IT support company’s remote monitoring tool was US-hosted and held administrator credentials for every device.
• The sales team had adopted an AI meeting note-taker on a free plan, which sent client call recordings to a third-party model provider.
• No agreement contained flow-down clauses or required notice of sub-processor changes.

What changed

• The two UK-only clients’ campaigns were moved to an email platform with UK data residency, and the change recorded.
• The IT support company agreed to move credentials into a UK-hosted vault and to notify any change of tooling, by addendum.
• The AI note-taker was replaced with the meeting transcription already included in Microsoft 365, and a line added to the cloud services policy.
• Sub-processors and data locations were recorded against each Tier 1 supplier in the register, and “any changes to sub-processors?” added to the annual review questions.

About a day of effort. The most valuable finding, the email platform, would otherwise have surfaced in a client audit rather than an internal one.

How control 5.21 links to other clauses and controls

• Control 5.19, Information security in supplier relationships. The process and the register that 5.21 extends one step down the chain.
• Control 5.20, Addressing information security within supplier agreements. Where sub-processor disclosure, change notification and flow-down are agreed.
• Control 5.22, Monitoring, review and change management of supplier services. Where changes in the chain are caught at each review.
• Control 5.23, Information security for use of cloud services. Most supply chains now run through cloud platforms, and the same questions apply.
• Control 5.34, Privacy and protection of PII. UK GDPR requires processors to have authorisation before engaging sub-processors. That is supply chain control by law.
• Control 8.8, Management of technical vulnerabilities. Supported, patched technology is the product side of a secure supply chain.

Frequently asked questions

What is the ICT supply chain in ISO 27001?

It is everyone involved in delivering the technology products and services you use, not just the supplier you contract with. For a small business that usually means your SaaS providers, the cloud platforms they run on, your IT support company and the tools it uses, and the vendors of the hardware and software you buy.

Do I need to assess my suppliers’ suppliers?

Not individually, in most cases. You need to know who your key suppliers rely on and where your data goes, require them to pass your requirements on, and make sure you are told about changes. Your direct supplier’s own assurance, such as a SOC 2 report covering its hosting, is usually how you get comfort about the layer beneath.

How do I find out who my suppliers’ sub-processors are?

Check the supplier’s published sub-processor list, which most SaaS providers maintain. Read the contract or data processing agreement. And ask directly, as part of your supplier questionnaire, which other companies handle your data on their behalf and where they are based.

Does 5.21 apply to open source software?

Yes, if you develop software. The libraries and components in your product are part of your ICT supply chain. Know what you depend on, keep it updated, and have a way to find out when a component you use has a known vulnerability.

What is a flow-down clause?

A clause in your agreement with a supplier requiring them to impose the same security and data use obligations on anyone they subcontract to. Without it, a restriction you agreed with your supplier may not bind the party who actually handles your data.