ISO 27001 Control 5.22: Monitoring, Review and Change Management of Supplier Services

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

Controls 5.19 and 5.20 get you to the point of signing. Control 5.22 is everything after that: keeping an eye on whether the supplier does what they said they would, and noticing when something about the service changes.

The most common finding I see here is not a missing process. It is a lapsed one. Thorough assessments at implementation, then nothing until the auditor asks when the last review happened. Surveillance auditors look specifically at the gap between the last review date and today.

The good news is that a small business does not need to go mad with this. A short annual evaluation of each supplier that matters, asking three or four honest questions and writing down the answers, is usually enough to show that you manage your suppliers rather than simply acquiesce to them. This page shows you what that looks like, and why supplier changes deserve more attention than they usually get.

What control 5.22 actually asks for

The requirement is that the organisation regularly monitors, reviews, evaluates and manages change in supplier information security practices and service delivery. Unpacked:

• Monitoring: keeping an eye on how the supplier is performing against what they agreed, including service levels and security obligations.
• Reviewing: periodically stepping back and asking whether the relationship still meets your needs and your risk appetite.
• Evaluating: reaching a conclusion, and recording it, rather than just collecting information.
• Managing change: noticing when the supplier changes something, or when your own use of them changes, and assessing what it means.

In the 2013 edition this was split across A.15.2.1 (monitoring and review) and A.15.2.2 (managing changes). The 2022 revision merged them into one control.

Where 5.22 sits among the supplier controls

Five controls in the 2022 edition deal with suppliers. 5.22 is the ongoing one.

5.22 is the ongoing half of 5.19. Your supplier assessment is a snapshot taken before you committed. Your agreement says what the supplier promised. 5.22 is how you know, a year later, whether either is still true.

A proportionate annual review

For each supplier that matters, once a year, sit down and ask yourself:

• Has anything changed? In the service, in how you use it, in who they are, or in what you have promised your own customers since you last looked.
• Did they perform according to their contractual responsibilities? Availability, response times, support, and the security obligations you agreed.
• Did they have any breaches or security incidents? Ones that affected you, ones you read about in the news, and ones they should have told you about and did not.
• Is their assurance still current? Is the ISO 27001 certificate or SOC 2 report in date, and does its scope still cover the service you use?

Write down the answers and a conclusion. That is genuinely enough for most small businesses. It shows that you are making an active judgement about each relationship, rather than renewing on autopilot.

Set the frequency by tier

• Tier 1 (holds your information or can reach your systems): at least annually, more often for the highest-risk relationships.
• Tier 2 (critical to operating, holds nothing sensitive): a lighter annual check of performance and continuity, and a proper look at renewal.
• Tier 3 (out of scope): no individual review, but look over the list once a year to catch anyone whose role has changed.

What a Tier 1 review should cover

• Any security incidents, near misses or disclosed vulnerabilities affecting you in the last twelve months?
• Is their certificate or report still current, and does the scope still cover the services they provide to you?
• Any new sub-processors, infrastructure changes or data centre moves?
• Are they meeting their contractual security obligations, and are the data processing terms still accurate?
• Any planned changes over the next year, including ownership?
• Is there news or threat intelligence that changes your view of them, and is your risk rating still right?

This rarely needs a site visit. A short questionnaire, a video call with their security contact or a review of current certificates is usually enough, provided you document it.

Record an outcome

Close each review with one of three outcomes: continue with no action; continue but monitor, with an action or an earlier next review; or action required, meaning formal corrective action, a contract review or exit. Keep the date, who took part, what was asked, the answers, the outcome and the next review date. The format matters much less than the substance.

When a supplier changes something

This is the half of the control that gets the least attention, and it is the one that can do the most damage.

Suppliers change things all the time. They move workloads to a new data centre. They add sub-processors. They get acquired. They retire a feature you relied on or introduce one you did not ask for. Most of these changes are announced, in an email or a terms update that nobody at your end reads.

Here is why it matters. When a supplier changes something, it can put you in breach of contract with your own customers. If you have promised a client that their data will only be processed within the EU, and your supplier quietly starts using a sub-processor in the United States, you are now in breach, whether or not you knew. Your customer will not be interested in the fact that it was your supplier’s decision.

So managing change, in practice, means:

• Someone receives supplier notices. Change notifications, sub-processor updates and terms changes should go to a named person or a shared mailbox someone actually reads, not to whoever happened to sign up in 2021.
• Significant changes are assessed, against what you have promised your own customers and against your risk assessment. Data location, sub-processors and security obligations are the ones that matter most.
• Your own changes count too. If you start putting client data into a tool you previously used only for internal notes, the supplier has not changed but your risk has. That triggers a review.
• The outcome is recorded, even if it is “reviewed, no impact”.

Awkward situations

A supplier will not complete your questionnaire

Common with large platforms, and that is fine. Use their published certificates, SOC 2 or SOC 3 reports, whitepapers and standard terms, and document that you obtained alternative assurance. A Tier 1 supplier that offers no assurance at all, and will not answer questions either, is a risk to escalate rather than accept quietly.

A supplier has an incident

Assess the impact on your data and systems. Check whether it triggers your own notification obligations, to customers or to the ICO. Log it as an incident under your incident management process, record it against the supplier, and factor it into the next review, including whether the relationship should continue.

Performance is poor but there is no obvious alternative

Record it anyway. A documented pattern of missed service levels is what gives you leverage at renewal, and it is the evidence that you are monitoring rather than tolerating. If the supplier is critical, make sure losing them is covered in your continuity planning.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call

What auditors will look for

As a Lead Auditor, this is broadly how I would work through 5.22.

1. The last review of your most important supplier. When was it, what was asked, and what was the conclusion? If the answer is “at implementation”, that is the finding.
2. Review dates across the register. I am looking for the gap between the last review and today, and for suppliers that have never been reviewed at all.
3. Performance. How has a key supplier actually done against its service levels and security obligations, and where is that written down?
4. A supplier change. Pick a recent sub-processor update or terms change from a major supplier. Who received it, and was it assessed?
5. A supplier incident. If one of your suppliers had a publicised breach in the last year, what did you do about it?
6. Outcomes. Has any review ever concluded anything other than “continue”? If not, I may ask how rigorous the reviews are.

Common issues

• Suppliers assessed once at implementation and never again.
• Reviews that consist of a date in a spreadsheet, with no record of what was asked or concluded.
• Supplier change notifications going to a former employee’s mailbox.
• A supplier change that put the business in breach of its own customer commitments, unnoticed until a customer asked.
• Publicised supplier breaches with no record of any assessment of the impact.
• Performance problems tolerated for years because nobody wrote them down.
• Tier 3 suppliers reviewed with the same effort as Tier 1, so the reviews that matter are rushed.
• Every review concluding “no change”, year after year.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• When did you last review your most important supplier, and where is the record?
• Who in your business receives change and sub-processor notifications from your main cloud suppliers?
• Has any supplier change in the last year affected what you have promised your own customers?
• Did any of your suppliers have a security incident last year, and what did you do about it?
• Which of your suppliers has never been reviewed since you signed?

A worked example

The figures below are typical rather than drawn from a single engagement. This is a composite of a first round of proper supplier reviews in a business of this size.

A 35-person fintech with eleven Tier 1 suppliers and four Tier 2, preparing for its first ISO 27001 surveillance audit. Its contracts with two bank customers require processing to stay within the UK and EU.

What the reviews found

• Six of the eleven Tier 1 suppliers had not been looked at since the initial assessment fourteen months earlier.
• The customer support platform had added a US-based AI sub-processor for ticket summarisation four months before. The notification had gone to a founder’s personal inbox and been archived.
• The hosting provider had missed its availability commitment in two of the last twelve months. Nobody had recorded it.
• One supplier’s ISO 27001 certificate had lapsed during a change of certification body.

What changed

• The AI summarisation feature was switched off for the bank customers’ tickets, the change recorded, and both banks informed proactively.
• Supplier notices were redirected to a shared mailbox owned by the operations lead, with a monthly check.
• The hosting provider’s missed months were recorded, raised at a service review, and used to agree service credits.
• The lapsed certificate was chased; the new one arrived three weeks later and was filed.
• All fifteen Tier 1 and Tier 2 suppliers were reviewed, with outcomes recorded in the Review log and next review dates set.

About two days of effort for the first round. The AI sub-processor alone justified it: it was a straightforward breach of the bank contracts, found by the business rather than by the bank.

How control 5.22 links to other clauses and controls

• Control 5.19, Information security in supplier relationships. The process and tiering that decide which suppliers need reviewing, and how often.
• Control 5.20, Addressing information security within supplier agreements. What you agreed is what you review against.
• Control 5.21, Managing information security in the ICT supply chain. Sub-processor changes are caught here.
• Control 5.24, Information security incident management planning and preparation. Supplier incidents are incidents, and need handling as such.
• Control 5.31, Legal, statutory, regulatory and contractual requirements. Supplier changes can put you in breach of your own contracts.
• Clause 9.3, Management review. Supplier performance and incidents are worth reporting to management, particularly for the suppliers you depend on most.

Frequently asked questions

How often should suppliers be reviewed under ISO 27001?

The standard does not set an interval. Annually for suppliers that hold your information or can reach your systems is defensible for most small businesses, with an additional review when the service changes, the supplier has an incident, or the contract comes up for renewal.

What should a supplier review include?

Whether anything has changed, whether the supplier performed against its contractual responsibilities, whether it had any security incidents, and whether its certification or assurance is still current and in scope. Record the answers, a conclusion, and the date of the next review.

Do I need to meet suppliers to review them?

Rarely. A short questionnaire, a call with their security contact or a check of current certificates is usually enough for a small business. What matters is that the review happened, that it asked the right questions, and that the outcome is recorded.

What counts as a supplier change I need to manage?

Anything that could affect the security of your information or your obligations to others: new sub-processors, a change in where data is processed, changes to terms or service levels, a change of ownership, or a significant change in the service itself. Your own changes in how you use a supplier count too.

What if a supplier change breaches our own customer contracts?

Act quickly. Assess the impact, stop or work around the change for affected customers where you can, and talk to the customers concerned. It is far better for them to hear it from you than to find it in their own supplier audit. Then fix the process so the next change is caught earlier.