ISO 27001 Information Security Management Standard

Part 34 - A15 Supplier Relationships

Having mutually beneficial supplier relationships is one of the key basics of running any management system. I have previously written about this in my ISO 9001 certification series here. I also wrote about it here and here.

As I said at the time; “Too few organisations make supplier management a priority, but the ones that do reap impressive rewards. Risk is reduced because communication is open and two-way – which means you are much less likely to be caught unawares.”

So for ISO 27001 there is no difference to those principles.

However, Annex A.15 of ISO 27001 takes this a step further and targets some specific areas.

Firstly it looks at Information security in supplier relationships.

supplier-relationship-management

A.15.1 Information Security in Supplier Relationships

The objective of this clause is to ensure you protect your organisation’s assets that are accessible by suppliers.

The process for this is to:

Review all your assets you are managing as part of A8. Asset Management (see here).
Check that controls for mitigating the risks associated with your supplier’s access to those assets are agreed with the supplier
Document those agreements.

Here at Mango we documented those supplier interactions and risks and discussed them with the supplier’s management. We then documented those into our supplier agreements. The areas covered the following:

Supplier access
Processing facilities
Storage
Communication
IT infrastructure components

Next up is supplier service delivery management.

A.15.2 Supplier Service and Delivery Management

The objective here is to maintain your agreed level of information security and service delivery in line with your supplier agreements.

This is closely related to the A.15.1 above.

First up you need to regularly monitor, review and audit supplier service to your business.

Here at Mango monitor performance monthly in our Management Review. We then review and audit the suppliers annually. We have an audit checklist in Mango to do this.

Secondly you need to manage the changes to services by your suppliers. This includes maintaining and improving information security policies, procedures and controls. You need to take into account the criticality of business information, systems and processes involved and re-assessment of risks.

Here at Mango we use our improvement module to manage changes to the provision of service. We check the risks involved and seek signoff along the process.

Takeaways

Seek to have a mutually beneficial relationship with all your critical suppliers.
Review all your assets and how your suppliers access and interact with them.
Check that the controls are agreed with the supplier.
Document those into agreements with the supplier.
Monitor and review your supplier’s performance against those agreements.
Make sure you effectively manage changes with your suppliers.

View previous blogs in this series "ISO 27001 Information Security Management Standard":

Part 1 - Reasons why you need to meet this standard

Part 2 - Principle 1 - Analysing the Protection of Your Information and then Applying Controls

Part 3 - Principle 2 - Awareness of the Need for Information Security

Part 4 - Principle 3 - Assignment of Responsibility for Information Security

Part 5 - Principle 4 - Incorporating Management Commitment and the Interests of Stakeholders

Part 6 - Principle 5 - Enhancing Societal Values

Part 7 - Principle 6 - Risk assessments determining appropriate controls to reach acceptable levels of risk

Part 8 - Principle 7 - Security incorporated as an essential element of information networks and systems

Part 9 - Principle 8 - Active prevention and detection of information security incidents

Part 10 - Principle 9 - Ensuring a comprehensive approach to information security management

Part 11 - Principle 10 - Continual reassessment of information security and making of modifications as appropriate