ISO 27001 A.5.19: Manage Supplier Security Risks
ISO 27001 A.5.19 addresses processes for managing information security risks arising from suppliers’ products and services. It applies beyond technology vendors. A records store, design subcontractor or maintenance provider can affect confidentiality, integrity or availability even when it never appears on the IT supplier list.
What A.5.19 requires in practice
Control A.5.19 expects the organisation to define and operate processes for managing the information security risks that come with using suppliers' products or services. It asks for a working process, not merely a list of vendors. In practice the control has four parts: deciding which supplier relationships are in scope, including those that sit outside the IT department; understanding what information, assets or systems each supplier can touch; setting conditions of use that match that exposure; and keeping the process running as suppliers are added, changed or replaced.
The outputs are decisions and records showing the process was applied to real suppliers. The control statement does not prescribe how detailed an assessment must be, so that is a risk-based judgement for the organisation. One way Sterling's teams approach it is to sort suppliers by exposure; a sorting model is a method, not a requirement.
Assess the relationship, not just the company
Identify what information the supplier receives, what assets or systems it can reach and what would happen if its service became unavailable or unreliable. A low-cost support arrangement with privileged access can create more consequential exposure than a large purchase with no sensitive information involved.
Assign an internal owner who understands the service and can act on findings. Procurement may coordinate the process, but operational, security and relevant legal expertise may be needed. Establish an assessment route before access or data transfer begins, including for trials and urgent purchases that might otherwise bypass normal onboarding.
Match assurance to risk. A questionnaire can help organise questions, while scoped certification, reports, demonstrations or other evidence may answer particular concerns. Examine coverage and limitations. A certificate for one part of a supplier does not automatically cover the product, location or service your organisation uses.
Translate concerns into operating decisions
Assessment should produce a decision about conditions of use, required improvements or whether the relationship is acceptable. A red flag left in a spreadsheet without an owner does not treat risk. If use proceeds with a limitation, record the authorised decision, compensating measures where appropriate and the point for reconsideration.
Clarify the work your organisation must still perform. A supplier may provide a secure platform while your team controls user access and data configuration. Conversely, internal controls cannot compensate for every weakness in a service on which the business depends. Make shared responsibilities visible to the people operating the arrangement.
Why supplier risk management matters to the business
Customers rarely distinguish between a failure inside your organisation and one at a company you chose to work with. If a supplier loses client data, your name is on the complaint, your contract carries the penalty and your team handles the recovery. Weak supplier control also hides cost: unplanned dependencies, duplicated services and surprise outages. For an auditor, this control is a quick test of whether risk assessment reaches beyond your own walls. Organisations that can show who owns each supplier relationship, what was decided and why usually answer supplier questions from clients and regulators faster, with less disruption to sales and delivery.
How to implement A.5.19
Start small and make the process real for a few suppliers before widening it. The steps below describe one workable route. Do not wait for a perfect supplier inventory before acting. Choose the handful of suppliers with the most access to client information, run the route end to end, and learn what is awkward. Procurement, security and the business owner each see different risks, so involve all three. Keep the output of each assessment short enough that a decision-maker will read it.
- Compile the suppliers actually in use by asking finance, procurement and each department head, not only IT.
- Record what each supplier receives, what it can reach and what happens if it fails.
- Group suppliers by exposure so effort follows risk.
- Agree what assurance suits each group, such as a questionnaire, a scoped report or a short call.
- Name an internal owner for every relationship who can act on findings.
- Route trials and urgent purchases through the same check before data is shared.
- Review the list when suppliers change and feed lessons into risk assessment.
Illustrative construction example: a specialist design subcontractor
A hypothetical contractor engages a small specialist to review a sensitive building design. Procurement initially categorises the supplier as low risk because the fee is modest. The actual exchange includes detailed drawings and access to a project workspace.
The project owner assesses the information and access, agrees an appropriate sharing route and limits the workspace permissions to the assignment. Completion includes removal of access and an agreed disposition of retained material. The assessment remains proportionate, but it is driven by exposure rather than the purchase value.
Illustrative BPO example: a critical communications service
A hypothetical BPO operation relies on an external communications provider to receive customer calls. The supplier holds little sensitive customer content in its routine billing records, so an assessment focused only on confidentiality initially rates it as unimportant.
The operations team examines availability and recovery dependencies. It identifies what work can continue during interruption and what information the provider must supply during an incident. The resulting supplier requirements address the business dependency. A confidentiality agreement alone would not have addressed the most consequential risk.
Plan change and exit before they become urgent
Determine how the relationship can end without losing necessary information or leaving inappropriate access. Consider usable data return, continuing confidentiality and the removal or transfer of dependencies. The details will differ between a short assignment and a core managed service.
Where a large supplier will not negotiate individual terms, assess the offered arrangement accurately. Alternatives may include narrowing use, adding internal protections or selecting a different service. Record what remains outside your control. Limited bargaining power does not mean the risk has disappeared, nor does ISO 27002 require an organisation to claim rights it does not possess.
Evidence should show decisions throughout the relationship
The selected control calls for defined and implemented processes. A supplier register, risk tier and review form are optional ways to organise them. Useful evidence connects supplier identification, assessment, approval conditions, operational responsibilities and exit decisions.
Sample a recent supplier from purchase request to actual use. Check whether its data and access match the assessment. Common failures include questionnaires with no evaluation, unassessed subcontracting, expired assurance treated as current and supplier lists that exclude local purchases. Link technology dependencies to ICT supply-chain security when deeper dependencies matter.
Common nonconformities with A.5.19
Auditors usually find gaps where the process exists on paper but not in practice. Auditors usually find gaps where the process exists on paper but not in practice, and they often test this by picking a supplier at random and asking the owner to explain what was decided and why.
- A supplier list covering only IT vendors, while a records store or maintenance provider with access is missing.
- Assessments done once at onboarding with no owner for the findings.
- Certificates accepted without checking that the scope covers the service actually used.
- Trials or urgent purchases that bypassed the process and now hold live data.
Frequently asked questions
Does every supplier need the same assessment?
No. Use a proportionate process based on information exposure, access, dependency and obligations. Applying the same long questionnaire to every supplier can obscure the relationships needing closer attention.
Is an ISO 27001 certificate sufficient assurance?
It can be relevant evidence, but inspect its scope and how it relates to your service. You still need to assess your own use, responsibilities and any material gaps.
What if a supplier refuses additional security terms?
Evaluate the available terms and residual risk. Consider alternative arrangements or additional controls, and obtain appropriate authority for the decision. Do not record unagreed requirements as if they were enforceable.
Make supplier assessments lead to action
Discuss supplier security with Sterling. ISO 27001 consulting can connect procurement, service ownership and scoped Effivity ISO & GRC automation software. Develop owners’ control knowledge with 93 Annex A Controls training. Implementation and preparation support does not replace independent certification. Return to the organisational controls guide.