#iso27001/2013
# ISO 27001 A 15 Supplier relationships
A.15.1 | Information security in supplier relationships ||
--- | :----------------------- | :--- |
Objective: To ensure protection of the organization’s assets that is accessible by suppliers. |||
A.15.1.1 | Information security policy for supplier relationships | Information security requirements for mitigating the risks associated with supplier’s access to the organization’s assets shall be agreed with the supplier and documented. |
A.15.1.2 | Addressing security within supplier agreements | All relevant information security requirements shall be established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for, the organization’s information. |
A.15.1.3 | Information and communication technology supply chain | Agreements with suppliers shall include requirements to address the information security risks associated with information and communications technology services and product supply chain. |

A.15.2 | Supplier service delivery management ||
--- | :----------------------- | :--- |
Objective: To maintain an agreed level of information security and service delivery in line with supplier agreements. |||
A.15.2.1 | Monitoring and review of supplier services | Organizations shall regularly monitor, review and audit supplier service delivery. |
A.15.2.2 | Managing changes to supplier services | Changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures and controls, shall be managed, taking account of the criticality of business information, systems and processes involved and re-assessment of risks. |

