ISO 27001 A.5.22: Review Supplier Security as It Changes
ISO 27001 A.5.22 addresses ongoing monitoring, review, evaluation and change management of supplier security practices and service delivery. Approval at onboarding is a starting point. The organisation needs to know whether the agreed arrangement continues to operate and whether changes alter the risk it originally accepted.
What A.5.22 requires in practice
Control A.5.22 asks the organisation to monitor, review, evaluate and manage change in suppliers' security practices and service delivery on a regular basis. Signing an agreement and onboarding a supplier is not the end of the control. The supplier's staff, systems, locations and subcontractors change over time, and so does your own use of the service.
In practice the control has two strands. The first is routine oversight: checking that the supplier still delivers what was agreed and still meets the security expectations set. The second is change management: noticing and handling changes on either side, whether a new feature, a different data centre or a revised scope. The standard leaves frequency and depth to the organisation; a review cycle matched to supplier criticality is one method that suits many organisations.
Why reviewing suppliers matters to the business
A supplier that was sound at the start can drift. Staff turnover, a merger or a hurried product change can quietly alter the risk you accepted. If nobody is watching, you find out through an incident or a client questionnaire. Regular review turns small warnings into planned actions and gives you leverage when raising concerns. It also shows auditors that supplier decisions are living and not frozen at the date of signature. The cost is modest when review effort follows importance, and far lower than recovering from a failure you could have seen coming.
How to implement A.5.22
Make review part of how the relationship is run, not a separate exercise. One approach follows. The difficulty with oversight is keeping it going once the novelty fades. Fit review into meetings and reports that already exist, so it does not depend on one enthusiastic person. Treat the supplier as a partner in the review where the relationship allows, since accurate reporting from them is your best early warning. Keep notes of what you looked at and what was agreed, so the next reviewer can pick up.
- Assign each supplier an owner responsible for oversight.
- Set a review rhythm that reflects how critical the service is.
- Define what to look at, such as service reports, incidents, certificate scope changes and complaints.
- Ask suppliers to tell you about relevant changes and record those they report.
- Assess any change for its effect on your risk before it takes effect where possible.
- Record decisions and agree actions with the supplier.
- Escalate persistent problems to management and consider alternatives.
Choose evidence that tests the important commitments
Identify which security outcomes need ongoing assurance and how they can be observed. Service availability reports may matter, but they do not establish how access is controlled or whether incidents are handled appropriately. Match evidence to the commitment rather than accepting whichever dashboard is easiest for the supplier to produce.
Evaluate report scope, period and limitations. An independent report can be useful, but its findings and customer responsibilities need interpretation. A document covering a different service or an earlier operating model may not answer the current question. Record what the reviewer concluded and what follow-up is required.
Assign the relationship to people with enough technical and operational understanding to act. Procurement can coordinate, but a specialist may need to interpret a significant configuration, resilience or vulnerability issue. Give the owner a route to escalate unresolved concerns before they become routine exceptions.
Treat change notices as decisions waiting to be made
Suppliers change locations, products, support arrangements and subcontractors. Determine which notices must reach your organisation and who assesses them. A message delivered to a former employee’s mailbox does not provide useful change control.
Assess how the proposed change affects information, access, dependency and existing obligations. Some changes may require no additional action; others may require testing, revised controls or a new acceptance decision. Keep the reasoning proportionate and visible. Where the supplier offers limited choice, evaluate available alternatives instead of recording an approval that had no practical meaning.
Common nonconformities with A.5.22
Review findings usually point to oversight that stopped after onboarding. Review findings usually point to oversight that stopped after onboarding. An auditor typically asks the supplier owner what has happened since signature and looks for records that show the relationship was actively managed.
- No evidence of any supplier review since the contract began.
- Service reports collected but never read or discussed with the supplier.
- A supplier changed location or subcontractor and the organisation was unaware.
- Review actions raised but no owner or follow-up recorded.
Illustrative BPO example: support moves to another provider
A hypothetical BPO company uses a workforce platform with supplier-operated technical support. A notice announces a new support subcontractor. The commercial service remains available, so the notice is initially treated as administrative.
The service owner checks whether the change affects access to employee information, incident coordination or agreed processing arrangements. Relevant specialists assess the implications before the changed service is relied upon. The review records the decision and any revised controls. Monitoring has detected a change that an uptime score would never reveal.
Illustrative construction example: a portal’s export function changes
A hypothetical construction business relies on a project document portal. A product update changes the format of exported drawings and associated revision information. Users can still open files, but the export no longer carries the metadata needed for a controlled handover.
The project owner tests the changed export against the agreed handover requirement and raises the gap with the supplier. A temporary controlled method is established while the issue is resolved. The organisation monitors a security-relevant integrity and availability need, rather than treating every successful login as proof of acceptable service.
Follow findings through to a verified result
A review should lead to action when commitments are not met. Agree the issue, responsibility, expected outcome and a suitable timescale. Evaluate interim risk while corrective work proceeds. Repeated deferral may require escalation or reconsideration of the relationship, particularly where the service is critical.
Verify completion using relevant evidence. A supplier statement that an issue is closed may be sufficient for a minor administrative point, but a consequential control failure may need stronger confirmation. Connect lessons from incidents with incident learning and examine whether similar dependencies exist elsewhere.
Keep review effort proportionate
A low-exposure supplier may need a simpler review than a managed service with privileged access. Changes, incidents and deteriorating performance can justify additional attention between planned reviews. Do not let a fixed annual date delay response to new information.
Evidence can include evaluated service reports, review decisions, change assessments, incident discussions and verified actions. A.5.22 does not require a particular supplier scorecard. Common failures include collecting certificates without reading their scope, discussing only price at renewal and leaving unresolved security issues outside the commercial decision.
Sample a recent change from notice to outcome. Ask whether the owner understood it, considered the relevant requirements and checked any resulting action. This provides stronger assurance than counting the number of supplier meetings held. Where deeper dependencies are affected, consult ICT supply-chain risk.
Frequently asked questions
Does renewing a supplier questionnaire count as monitoring?
It can contribute, but it should not replace evaluation of actual performance, incidents and changes. Ask whether the updated answers affect a decision or reveal something the organisation must act upon.
Must every supplier attend quarterly security meetings?
No universal interval or meeting format is prescribed. Choose methods and timing appropriate to risk, commitments and change. The important point is effective review and follow-through.
What if the supplier changes terms without negotiation?
Assess the effect on your use and obligations, then decide on acceptable treatment or alternatives. Limited negotiating power does not remove the need to evaluate the changed arrangement.
Make supplier oversight useful between renewals
Request Sterling support for supplier review design. Consulting and scoped Effivity ISO & GRC automation software can connect review responsibilities with evidence and action. Strengthen the team through 93 Annex A Controls training. Independent certification remains separate. Return to the organisational controls guide.