#iso27002/2022/EN
## 5.19 Information security in supplier relationships

**Control**

Processes and procedures should be defined and implemented to manage the information security risks associated with the use of supplier’s products or services.

**Purpose**

To maintain an agreed level of information security in supplier relationships. 

**Guidance**

The organization should establish and communicate a topic-specific policy on supplier relationships to all relevant interested parties.

The organization should identify and implement processes and procedures to address security risks associated with the use of products and services provided by suppliers. This should also apply to the organization’s use of resources of cloud service providers. These processes and procedures should include those to be implemented by the organization, as well as those the organization requires the supplier to implement for the commencement of use of a supplier’s products or services or for the termination of use of a supplier’s products and services, such as:

a\) identifying and documenting the types of suppliers (e.g. ICT services, logistics, utilities, financial services, ICT infrastructure components) which can affect the confidentiality, integrity and availability of the organization's information;

b\) establishing how to evaluate and select suppliers according to the sensitivity of information, products and services (e.g. with market analysis, customer references, review of documents, on-site assessments, certifications);

c\) evaluating and selecting supplier’s products or services that have adequate information security controls and reviewing them; in particular, accuracy and completeness of controls implemented by the supplier that ensure integrity of the supplier’s information and information processing and hence the organization’s information security;

d\) defining the organization’s information, ICT services and the physical infrastructure that suppliers can access, monitor, control or use;

e\) defining the types of ICT infrastructure components and services provided by suppliers which can affect the confidentiality, integrity and availability of the organization's information;

f\) assessing and managing the information security risks associated with:
	1\) the suppliers’ use of the organization’s information and other associated assets, including risks originating from potential malicious supplier personnel;
	2\) malfunctioning or vulnerabilities of the products (including software components and sub-components used in these products) or services provided by the suppliers;
  
g\) monitoring compliance with established information security requirements for each type of supplier and type of access, including third-party review and product validation;

h\) mitigating non-compliance of a supplier, whether this was detected through monitoring or by other means;

i\) handling incidents and contingencies associated with supplier products and services including responsibilities of both the organization and suppliers;

j\) resilience and, if necessary, recovery and contingency measures to ensure the availability of the supplier’s information and information processing and hence the availability of the organization’s information;

k\) awareness and training for the organization’s personnel interacting with supplier personnel regarding appropriate rules of engagement, topic-specific policies, processes and procedures and behaviour based on the type of supplier and the level of supplier access to the organization’s systems and information;

l\) managing the necessary transfer of information, other associated assets and anything else that needs to be changed and ensuring that information security is maintained throughout the transfer period;

m\) requirements to ensure a secure termination of the supplier relationship, including:

 1\) de-provisioning of access rights;
 2\) information handling;
 3\) determining ownership of intellectual property developed during the engagement;
 4\) information portability in case of change of supplier or insourcing;
 6\) records management;
 7\) return of assets;
 8\) secure disposal of information and other associated assets;
 9\) ongoing confidentiality requirements;

n\) level of personnel security and physical security expected from supplier's personnel and facilities.

The procedures for continuing information processing in the event that the supplier becomes unable to supply its products or services (e.g. because of an incident, because the supplier is no longer in business, or no longer provides some components due to technology advancements) should be considered to avoid any delay in arranging replacement products or services (e.g. identifying an alternative supplier in advance or always using alternative suppliers).

**Other information**

In cases where it is not possible for an organization to place requirements on a supplier, the organization should:

a\) consider the guidance given in this control in making decisions about choosing a supplier and its product or service;

b\) implement compensating controls as necessary based on a risk assessment.

Information can be put at risk by suppliers with inadequate information security management. Controls should be determined and applied to manage the supplier's access to information and other associated assets. For example, if there is a special need for confidentiality of the information, non-disclosure agreements or cryptographic techniques can be used. Another example is personal data protection risks when the supplier agreement involves transfer of, or access to, information across borders. The organization needs to be aware that the legal or contractual responsibility for protecting information remains with the organization.  

Risks can also be caused by inadequate controls of ICT infrastructure components or services provided by suppliers. Malfunctioning or vulnerable components or services can cause information security breaches in the organization or to another entity (e.g. they can cause malware infection, attacks or other harm on entities other than the organization).

See ISO/IEC 27036-2 for more detail.