The organization is to define and run processes and procedures that manage the information security risks arising from using suppliers' products or services. Purpose: keep security in dealings with suppliers at the level both sides agreed. Guidance: set a topic-specific supplier relationship policy and share it with relevant parties. Processes, including those applying to cloud service providers and those the organization requires suppliers to follow when use of a product or service starts or ends, should cover: identifying and recording the kinds of supplier (ICT services, logistics, utilities, financial services, infrastructure components) that could affect confidentiality, integrity or availability; deciding how suppliers are evaluated and chosen according to sensitivity, using market analysis, references, document review, on-site assessment or certification; choosing and reviewing products and services with adequate controls, especially the accuracy and completeness of controls protecting that the supplier's own information and processing stay intact; defining which information, ICT services and physical infrastructure suppliers may access, monitor, control or use; defining the supplier-provided infrastructure components and services that could affect the organization; assessing and managing risks from suppliers' use of the organization's assets (including malicious supplier staff) and from faulty or vulnerable products, components or services; monitoring compliance per supplier and access type, which can involve independent reviews and validating products; dealing with supplier non-compliance however it is found; handling supplier-related incidents and contingencies with each side's responsibilities; resilience, recovery and contingency so the supplier's information and processing stay available; awareness and training for staff who deal with supplier personnel; managing transfers of information and assets securely during transition; secure termination covering removal of access, information handling, ownership of intellectual property created, portability on change of supplier or insourcing, records management, returning assets, disposing of them securely and keeping confidentiality going afterwards; and the personnel and physical security expected of supplier staff and sites. Plans for continuing if a supplier can no longer deliver, for example by pre-identifying or routinely using alternatives, should be considered. Other information: where requirements cannot be imposed, use this guidance in choosing the supplier and add compensating controls based on risk; NDAs or cryptography can protect confidentiality, cross-border data access raises privacy risk, legal responsibility for the information stays with the organization, and vulnerable supplier components can harm the organization or others; ISO/IEC 27036-2 has more detail.
This control maps to 134 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 5.19 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 134 it maps to, and the evidence behind each claim, over MCP and REST.