Key takeaways
- Manage security risks that come from using suppliers.
- Suppliers often hold your data or run critical services.
- Start here: write a supplier security policy explaining how you assess and manage suppliers.
Purpose
Manage security risks that come from using suppliers.
Requirement
Requirement summaryProcesses and procedures shall be defined and implemented to manage the information security risks associated with the use of supplier’s products or services.
Why it matters
Suppliers often hold your data or run critical services. Their weaknesses become your risk.
How to implement
- Write a supplier security policy explaining how you assess and manage suppliers.
- Create a supplier inventory with the data and services each one touches.
- Tier suppliers by risk and set assessment depth accordingly.
- Assess suppliers before onboarding and record the decision.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.19. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your supplier security policy: how you check suppliers before using them.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.19 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Your supplier list, marked by how important or risky each one is.
- Completed security checks or questionnaires for your key suppliers.
Things you should be able to show or explain
- Be able to explain how security is considered when choosing a supplier.
How much to show: Three to five important suppliers.
Common mistakes
- Key suppliers never checked.
- Incomplete supplier list.
- Treating all suppliers the same regardless of risk.
- No inventory, so shadow suppliers are missed.
- Tip: Tier suppliers by risk so you focus effort on the critical ones.
Policies & documents to have
- Third-Party Management Policy
FAQ
Is A.5.19 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.19?
Be ready to explain how the control works in your organisation and to provide things like: Your supplier security policy: how you check suppliers before using them…