ISO 27001:2022
Organizational controls – ISO 27001:2022

ISO 27001:2022 5.20: Addressing information security within supplier agreements

The information security requirements that matter for each supplier are to be set and agreed with that supplier, depending on the type of relationship. Purpose (stated in ISO/IEC 27002:2022): makes the agreed security level for each supplier binding through written terms. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.20.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 142 controls across 32 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 16 controls

  • AC-20 Use of External Systems
  • AC-20(1) Limits on Authorized Use
  • CA-3 Information Exchange
  • CP-8(1) Telecommunications Services | Priority of Service Provisions (CP-8(1))
  • PS-7 External Personnel Security
  • RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
  • SA-4 Acquisition Process
  • SA-4(2) Acquisition Process | Design and Implementation Information for Controls (SA-4(2))
  • SA-4(9) Acquisition Process | Functions, Ports, Protocols, and Services in Use (SA-4(9))
  • SA-9 External System Services
  • SA-9(5) External System Services | Processing, Storage, and Service Location (SA-9(5))
  • SR-11 Component Authenticity (SR-11)
  • SR-2 Supply Chain Risk Management Plan (SR-2)
  • SR-3 Supply Chain Controls and Processes (SR-3)
  • SR-5 Acquisition Strategies, Tools, and Methods (SR-5)
  • SR-6 Supplier Assessments and Reviews (SR-6)

FedRAMP Moderate · 16 controls

  • AC-20 Use of External Systems
  • AC-20(1) Limits on Authorized Use
  • CA-3 Information Exchange
  • CP-8(1) Telecommunications Services | Priority of Service Provisions (CP-8(1))
  • PS-7 External Personnel Security
  • RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
  • SA-4 Acquisition Process
  • SA-4(2) Acquisition Process | Design and Implementation Information for Controls (SA-4(2))
  • SA-4(9) Acquisition Process | Functions, Ports, Protocols, and Services in Use (SA-4(9))
  • SA-9 External System Services
  • SA-9(5) External System Services | Processing, Storage, and Service Location (SA-9(5))
  • SR-11 Component Authenticity (SR-11)
  • SR-2 Supply Chain Risk Management Plan (SR-2)
  • SR-3 Supply Chain Controls and Processes (SR-3)
  • SR-5 Acquisition Strategies, Tools, and Methods (SR-5)
  • SR-6 Supplier Assessments and Reviews (SR-6)

NIST SP 800-53 Rev 5 · 15 controls

ISO 27701:2019 · 13 controls

  • 6.12 Supplier relationships
  • 6.12.1 Information security in supplier relationships
  • 7.2.6 Contracts with PII processors
  • 7.5 PII sharing, transfer, and disclosure
  • 7.5.4 Records of PII disclosure to third parties
  • 8.2.1 Customer agreement
  • 8.2.5 Customer obligations
  • 8.5.1 Basis for PII transfer between jurisdictions
  • 8.5.2 Countries and international organizations to which PII can be transferred
  • 8.5.3 Records of PII disclosure to third parties
  • 8.5.5 Legally binding PII disclosures
  • 8.5.6 Disclosure of subcontractors used to process PII
  • 8.5.8 Change of subcontractor to process PII

NIST Cybersecurity Framework 2.0 · 13 controls

  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
  • NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
  • NIST-CSF-GV.SC-04 Suppliers are known and prioritized by criticality
  • NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • NIST-CSF-GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
  • NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
  • NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
  • NIST-CSF-GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
  • NIST-CSF-GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
  • NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
  • NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared

HIPAA Security Rule · 7 controls

CIS Controls v8 · 6 controls

  • CIS-15.1 Establish and Maintain an Inventory of Service Providers
  • CIS-15.2 Establish and Maintain a Service Provider Management Policy
  • CIS-15.4 Ensure Service Provider Contracts Include Security Requirements
  • CIS-15.5 Assess Service Providers
  • CIS-15.6 Monitor Service Providers
  • CIS-15.7 Securely Decommission Service Providers

PCI DSS 4.0 · 6 controls

  • 11.4.7 11.4.7 Multi-tenant providers support customer penetration testing
  • 12.8.2 12.8.2 TPSP contracts acknowledging account data responsibility
  • 12.8.5 12.8.5 Responsibility allocation between entity and TPSPs
  • 12.9.1 12.9.1 TPSP written acknowledgments to customers
  • 12.9.2 12.9.2 TPSP support for customer information requests
  • 8.2.7 8.2.7 Third-party remote access accounts controlled

ISO 27002:2022 · 5 controls

  • 5.19 Information security in supplier relationships
  • 5.20 Addressing information security within supplier agreements
  • 5.21 Managing information security in the ICT supply chain
  • 5.31 Legal, statutory, regulatory and contractual requirements
  • 8.30 Outsourced development

SOC 2 · 5 controls

  • SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
  • SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk
  • SOC2-P6.1 P6.1 Disclosure to third parties with consent
  • SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
  • SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

NIST SP 800-161 Rev 1 · 4 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-01 Train Operational Teams in Information System Security
  • ANSSI-HYG-03 Control the Risks of Outsourced Information System Management
  • ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners

EU AI Act · 3 controls

  • EUAI-Art.22 Authorised representatives of providers of high-risk AI systems
  • EUAI-Art.25 Responsibilities along the AI value chain
  • EUAI-Art.60 Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes

APRA CPS 230 Operational Risk Management · 2 controls

  • CPS230-50 Formal Agreement Content for Material Arrangements
  • CPS230-P48 Required Content of the Service Provider Management Policy

APRA CPS 234 · 2 controls

  • CPS234-P19 Policy Direction to All Responsible Parties
  • CPS234-P22 Evaluation of Third Party Control Design

Australia My Health Records Act 2012 · 2 controls

  • MYHR-REG-4 Contracted service provider oversight
  • MYHR-REG-8 Copyright conditions on handling old records for operators and service providers

C5 (Germany) · 2 controls

  • C5-SSO-01 Policies and instructions for controlling and monitoring third parties
  • C5-SSO-04 Monitoring of compliance with requirements

COBIT 2019 · 2 controls

  • APO10.03 APO10.03 Manage vendor relationships and contracts
  • DSS01.02 DSS01.02 Manage outsourced I&T services

ISO/IEC 42001:2023 · 2 controls

  • A.10 Third-party and customer relationships
  • A.10.3 Suppliers

NIST SP 800-171 Rev 3 · 2 controls

  • 03.16.03 External System Services
  • 03.17.02 Acquisition Strategies, Tools, and Methods

APPI · 1 control

AWS Well-Architected Security Pillar · 1 control

  • SEC03-BP09 Share resources securely with a third party

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • AEO-7 Trading Partner Security

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-26 Own Resources or Contractual Arrangements to Meet the Recovery Objective

DORA · 1 control

GDPR · 1 control

ISO 27001:2013 · 1 control

  • A.15.1.2 Addressing security within supplier agreements

NIS2 Directive · 1 control

  • Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider

NIST SP 800-172 · 1 control

  • 3.11.7e Supply Chain Risk Management Plan

NIST SP 800-218 · 1 control

NIST SP 800-66 Rev 2 · 1 control

  • 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Organizational controls – ISO 27001:2022

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 5.20 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold ISO 27001:201383.9% covered · 15 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 142 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27001:2022 controls