Key takeaways
- Regularly check suppliers keep their security promises and manage changes.
- Supplier risk changes over time.
- Start here: schedule periodic reviews based on supplier tier.
Purpose
Regularly check suppliers keep their security promises and manage changes.
Requirement
Requirement summaryThe organization shall regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.
Why it matters
Supplier risk changes over time. Ongoing monitoring catches problems before they become incidents.
How to implement
- Schedule periodic reviews based on supplier tier.
- Review certifications, audit reports and performance against agreed terms.
- Manage changes to supplier services through an assessment step.
- Record review outcomes and actions.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.22. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for monitoring suppliers and handling changes.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.22 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Notes from regular supplier reviews covering security.
- Supplier certificates or independent security reports, with notes showing someone read them.
- Records of checking the security impact when a supplier changed its service.
Things you should be able to show or explain
- Be able to explain what you do when a supplier falls short.
How much to show: Your most important suppliers' latest reviews.
Common mistakes
- Reports collected but never read.
- Key suppliers not reviewed this year.
- Assessing suppliers once at onboarding and never again.
- Expired supplier certificates nobody noticed.
- Tip: Review critical suppliers at least annually.
Policies & documents to have
- Third-Party Management Policy
FAQ
Is A.5.22 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.22?
Be ready to explain how the control works in your organisation and to provide things like: Your process for monitoring suppliers and handling changes…