---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.22"
title: "Monitoring, review and change management of supplier services"
theme: Organizational
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts: [Identify]
operational_capabilities: [Supplier_relationships_security]
security_domains:
  - Governance_and_Ecosystem
  - Protection
  - Defence
  - Information_security_assurance
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.22 Monitoring, review, and change management of supplier services

### Control
The organization should regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.

### Purpose
To maintain an agreed level of information security and service delivery in line with supplier agreements.

### Guidance
Monitoring, review and change management of supplier services should ensure the information security terms and conditions of the agreements are complied with, information security incidents and problems are managed properly and changes in supplier services or business status do not affect service delivery.

This should involve a process to manage the relationship between the organization and the supplier to:

a\) monitor service performance levels to verify compliance with the agreements;

b) monitor changes made by suppliers including:
1) enhancements to the current services offered;
2) development of any new applications and systems;
3) modifications or updates of the supplier’s policies and procedures;
4) new or changed controls to resolve information security incidents and to improve information security;

c) monitor changes in supplier services including:
1) changes and enhancement to networks;
2) use of new technologies;
3) adoption of new products or newer versions or releases;
4) new development tools and environments;
5) changes to physical location of service facilities;
6) change of sub-suppliers;
7) sub-contracting to another supplier;

d\) review service reports produced by the supplier and arrange regular progress meetings as required by the agreements;

e\) conduct audits of suppliers and sub-suppliers, in conjunction with review of independent auditor’s reports, if available and follow-up on issues identified;

f\) provide information about information security incidents and review this information as required by the agreements and any supporting guidelines and procedures;

g\) review supplier audit trails and records of information security events, operational problems, failures, tracing of faults and disruptions related to the service delivered;

h\) respond to and manage any identified information security events or incidents;

i\) identify information security vulnerabilities and manage them;

j\) review information security aspects of the supplier’s relationships with its own suppliers;

k\) ensure that the supplier maintains sufficient service capability together with workable plans designed to ensure that agreed service continuity levels are maintained following major service failures or disaster (see [[5.29]], [[5.30]], [[5.35]], [[5.36]], [[8.14]];

l\) ensure that suppliers assign responsibilities for reviewing compliance and enforcing the requirements of the agreements;

m\) evaluate regularly that the suppliers maintain adequate information security levels.


The responsibility for managing supplier relationships should be assigned to a designated individual or team. Sufficient technical skills and resources should be made available to monitor that the requirements of the agreement, in particular the information security requirements, are being met. Appropriate actions should be taken when deficiencies in the service delivery are observed.

### Other information
See ISO/IEC 27036-3 for more detail.