ISO 27001 supplier security: registers, assessments and what auditors check

Most small organisations run on suppliers: a cloud host, email and file storage, a payroll bureau, a managed IT provider, a developer. Each one can see or affect your information. Supplier security is how you decide which suppliers matter, check they're good enough, put the right terms in place, and keep an eye on them.

You can outsource the work. You can't outsource the responsibility.

Why it matters

Supplier security is covered by Annex A controls 5.19 to 5.23 of ISO/IEC 27001:2022. In summary:

• 5.19: have a process for managing the security risks of using suppliers.
• 5.20: agree security requirements with each supplier, in the contract or terms.
• 5.21: manage security risks in the ICT supply chain (the suppliers' suppliers).
• 5.22: monitor, review and manage changes to supplier services.
• 5.23: manage the security of the cloud services you use, from choosing them to leaving them.

Clause 4.3 also asks your scope to consider interfaces and dependencies with others, which in practice means your key suppliers.

What an auditor looks for

• A supplier register listing who you use, what they do, what information they handle, and how critical they are.
• Assessment in proportion to risk. Your critical suppliers have been checked (questionnaire, certificate, report); low-risk ones may need little.
• Security terms in contracts, such as confidentiality, breach notification, and the right to audit or evidence of controls.
• Ongoing review. Assessments or certificates are refreshed, typically yearly for critical suppliers.
• Cloud services covered, including how you'd get your data out if you left.

Common reasons it fails: no register; a cloud host missing from it; assessments that were sent but never reviewed; or certificates that expired long ago.

A simple way to tier suppliers

1. Critical: handles your confidential or personal data, or you can't operate without them (your cloud host, email, core software). Full assessment and yearly review.
2. Important: limited access or easily replaced (a design agency with occasional file access). Short questionnaire, or their certificate, and a review every two years.
3. Low: no access to your information (stationery, cleaning). Record them; no assessment needed.

Common mistakes, and how to keep it manageable

• Sending the same 200-question questionnaire to everyone. Match the depth to the tier.
• Re-checking what's already proven. If a supplier has a current ISO 27001 certificate covering the service you use, record it and check its scope and expiry instead of a full questionnaire.
• Copying supplier details into policies. Keep supplier facts in the register and link to them.
• Forgetting exit. For critical suppliers, know how you'd get your data back.

How to do it in ClearIMS

1. Start from the draft. The onboarding chat lists your suppliers from what you tell it.
2. Open the Supplier register and record each supplier's service, the information it handles and how critical it is.
3. Send an assessment. Choose a questionnaire template and send it. The supplier answers through a secure link, without needing an account, and can upload evidence.
4. Review and schedule. Review the answers, record your decision, and let a recurring supplier review task bring each critical supplier round again.

Related pages

• Supplier assurance triage: deciding how much checking a supplier needs.
• Questionnaire templates: what you send suppliers.
• Contract obligations: the security terms you've agreed.
• Assets: what your suppliers host or handle.