#iso27002/2022/EN
## 5.20 Addressing information security within supplier agreements

**Control**
Relevant information security requirements should be established and agreed with each supplier based on the type of supplier relationship.

**Purpose**
To maintain an agreed level of information security in supplier relationships.

**Guidance**
Supplier agreements should be established and documented to ensure that there is clear understanding between the organization and the supplier regarding both parties’ obligations to fulfil relevant information security requirements.

The following terms can be considered for inclusion in the agreements in order to satisfy the identified information security requirements:

a\) description of the information to be provided or accessed and methods of providing or accessing the information;

b\) classification of information according to the organization’s classification scheme (see [[5.10]], [[5.12]], [[5.13]])

c\) mapping between the organization’s own classification scheme and the classification scheme of the supplier;

d\) legal, statutory, regulatory and contractual requirements, including data protection, handling of personally identifiable information (PII), intellectual property rights and copyright and a description of how it will be ensured that they are met;

e\) obligation of each contractual party to implement an agreed set of controls, including access control, performance review, monitoring, reporting and auditing, and the supplier’s obligations to comply with the organization’s information security requirements;

f\) rules of acceptable use of information and other associated assets, including unacceptable use if necessary;

g\) procedures or conditions for authorization and removal of the authorization for the use of the organization’s information and other associated assets by supplier personnel (e.g. through an explicit list of supplier personnel authorized to use the organization’s information and other associated assets);

h\) information security requirements regarding the supplier’s ICT infrastructure; in particular, minimum information security requirements for each type of information and type of access to serve as the basis for individual supplier agreements based on the organization’s business needs and risk criteria;

i\) indemnities and remediation for failure of contractor to meet requirements;

j\) incident management requirements and procedures (especially notification and collaboration during incident remediation);

k\) training and awareness requirements for specific procedures and information security requirements (e.g. for incident response, authorization procedures);

l\) relevant provisions for sub-contracting, including the controls that need to be implemented, such as agreement on the use of sub-suppliers (e.g. requiring to have them under the same obligations of the supplier, requiring to have a list of sub-suppliers and notification before any change);

m\) relevant contacts, including a contact person for information security issues;

n\) any screening requirements, where legally permissible, for the supplier’s personnel, including responsibilities for conducting the screening and notification procedures if screening has not been completed or if the results give cause for doubt or concern;

o\) the evidence and assurance mechanisms of third-party attestations for relevant information security requirements related to the supplier processes and an independent report on effectiveness of controls;

p\) right to audit the supplier processes and controls related to the agreement;

q\) supplier’s obligation to periodically deliver a report on the effectiveness of controls and agreement on timely correction of relevant issues raised in the report;

r\) defect resolution and conflict resolution processes;

s\) providing backup aligned with the organization’s needs (in terms of frequency and type and storage location);

t\) ensuring the availability of an alternate facility (i.e. disaster recovery site) not subject to the same threats as the primary facility and considerations for fall back controls (alternate controls) in the event primary controls fail;

u\) having a change management process that ensures advance notification to the organization and the possibility for the organization of not accepting changes;

v\) physical security controls commensurate with the information classification;

w\) information transfer controls to protect the information during physical transfer or logical transmission;

x\) termination clauses upon conclusion of the agreement including records management, return of assets, secure disposal of information and other associated assets, and any ongoing confidentiality obligations;

y\) provision of a method of securely destroying the organization’s information stored by the supplier as soon as it is no longer required;

z\) ensuring, at the end of the contract, handover support to another supplier or to the organization itself.

The organization should establish and maintain a register of agreements with external parties (e.g. contracts, memorandum of understanding, information-sharing agreements) to keep track of where their information is going. The organization should also regularly review, validate and update their agreements with external parties to ensure they are still required and fit for purpose with relevant information security clauses.

**Other information**
The agreements can vary considerably for different organizations and among the different types of suppliers. Therefore, care should be taken to include all relevant requirements for addressing information security risks.

For details on supplier agreements, see ISO/IEC 27036 series. For cloud service agreements, see ISO/IEC 19086 series.