ISO is one of the most widely used vendor risk management frameworks. Certification to ISO/IEC 27001 is usually not mandated unless a client requires it to enter into a contract with them. Even so, any organization with sensitive information can find compliance with ISO 27001 useful and effective.
The popular international standard was developed by ISO, the International Organization for Standardization. It defines the requirements of an information security management system (ISMS) and has achieved international acclaim.
ISO/IEC 27001:2022 requires organizations to identify information security risks and select appropriate controls to treat them. Annex A provides a reference set of 93 controls organized into four themes: Organizational, People, Physical, and Technological.
ISO 27001 uses a risk-based approach to systematically safeguard sensitive data across technology, people, and processes. This includes the third-party supply chain vendors As no business with third-party service providers is immune to data breach, the standard includes a category of controls that address third-party supplier and supply chain risks.
Why Do Third-Party Relationships Introduce Risk?
Reliance on vendors is a growing trend and is likely going to keep growing due to the evolving nature of our digital economy. But this also means the occurrence of the inevitable risk of exposure through third-party breaches. Only carefully executed vendor risk management programs will protect organizations from third-party cybersecurity risks, and even these are not foolproof.
An organization with a well-defined ISMS can protect its supply chain relationships as well as its corporate reputation. When your current suppliers understand that you have a solid defense against information security threats, they may look forward to long-term partnerships with your organization. Additionally, assuring the protection of their vital confidential information will help your company’s reputation inside the industrial supply chain.
How are Supplier Relationships Defined in ISO 27001?
Under the ISO standard, managing supplier relationships means establishing and maintaining rules that keep shared information safe. Suppliers are any vendor or party that handles sensitive information. These connections may extend to business partners and consultants. Operations that involve supplier relationships range from outsourcing IT services to academic research on product development.
Third-party relationships have emerged as a category of their own in risk management solutions. On the one hand, they are excluded from an organization’s internal risk assessment process if the direct risks related to that third party cannot be reasonably treated by the organization. But on the other hand, can an organization simply disregard consideration of these issues under the guise that the third party is responsible for its own risks and controls?
Definitely not.
An entity that engages with your company and has access to sensitive information cannot be blindly trusted to manage its risks properly. There is inherent risk in any outsourced relationship and the greater the criticality to the ISMS, the greater the risk to the organization. Management would be required to consider that risk and determine in what way that risk should be treated.
So, while an organization cannot include the controls of a third-party provider within their internal ISMS, ISO has a dedicated category of controls to evaluate and monitor third-party providers to ensure that they are acceptably implemented.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
Which ISO Controls Address Third-Party Relationships?
Supplier-related requirements appear under the Organizational theme of ISO/IEC 27001:2022 Annex A. Controls 5.19 through 5.23 address information security across supplier relationships, agreements, ICT supply chains, supplier services, and cloud services.
ISO 27001:2022 supplier relationship controls
Control 5.19: Information security in supplier relationships
Organizations should establish processes for managing information security risks associated with suppliers. These processes should reflect the type of supplier, the information or systems involved, and the level of access provided.
Control 5.20: Addressing information security within supplier agreements
Relevant information security requirements should be defined and agreed upon with each supplier. Agreements may cover access controls, incident reporting, data handling, confidentiality, service continuity, audit rights, and responsibilities when the relationship ends.
Control 5.21: Managing information security in the ICT supply chain
Organizations should manage risks associated with ICT products and services throughout the supply chain. This includes setting security expectations, understanding dependencies, and addressing risks involving subcontractors and other downstream providers.
Control 5.22: Monitoring, review and change management of supplier services
Supplier services and security practices should be monitored and reviewed regularly. Organizations should also reassess risk when services, technologies, contracts, or supplier arrangements change.
Control 5.23: Information security for the use of cloud services
Organizations should establish processes for acquiring, using, managing, and exiting cloud services. Security responsibilities should be clearly defined, including requirements for data protection, access, monitoring, incident management, and service termination.
How can Centraleyes facilitate ISO Certification?
Centraleyes allows organizations to build custom questionnaires to develop risk assessments that are most relevant to the unique risk profiles of each asset or risk domain. This ensures you’re addressing the specific information security obligations each third-party vendor has agreed to and can be extended to fourth parties as well.
Vendor risk assessment results can be used to categorize vendors based on the levels of risk they pose to specific domains. This allows teams to efficiently distribute remediation efforts, focusing on vulnerabilities in the most critical assets.
Effectively implementing these controls improves your organization’s reputation from the perspective of potential customers and business partners.
Centraleyes is here to help you on your journey toward ISO certification. Schedule a free consultation today.