ISO 27001 A.5.21: technology supply chain, explained for startups

A.5.21 Managing information security in the ICT supply chain

You know which providers your technology suppliers rely on, and check they are secure. What proves it: the sub-processors behind your key technology suppliers, and a record that you reviewed them.

A certification auditor samples sub-processor lists and how they were reviewed. A file that usually does the job: your key suppliers' published sub-processor lists with a dated note of your review.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.21 walks you through it in this order.

1. For each key information and communications technology (ICT) supplier, find its sub-processor list.
2. Note any provider that would reach your data and check that it is acceptable.
3. Subscribe to change notices and review them when they arrive.

The free ISO 27001 readiness assessment asks one question that evidences it:

• How do you manage the suppliers and cloud services that handle your data?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Supplier and Cloud Service Security Policy covers A.5.21. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC9.2, vendor risk.

Organizational controls

A.5.21 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.18, granting and removing access
• A.5.19, supplier security
• A.5.20, security in supplier contracts
• A.5.22, watching your suppliers
• A.5.23, cloud services
• A.5.24, incident readiness

Before it: A.5.20, security in supplier contracts. After it: A.5.22, watching your suppliers. Every control, by theme, is on the Annex A controls page.