ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.20: Addressing information security within supplier agreements
ISO 27001:2022 5.20 covers Addressing information security within supplier agreements. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.20, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Standard procurement terms are used with no security schedule for high-risk suppliers.
The information security requirements that matter for each supplier are to be set and agreed with that supplier, depending on the type of relationship. Purpose (stated in ISO/IEC 27002:2022): makes the agreed security level for each supplier binding through written terms. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.20.
What evidence supports 5.20?
- Annex A organizational controlStatement of Applicability entry for control A.5.20, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlSupplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- Annex A organizational controlA register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
- Annex A organizational controlMinimum security requirement templates per information type and access type used as the basis for individual contracts
- Annex A organizational controlSupplier-provided attestations or independent control effectiveness reports and records of issues raised and corrected
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.20, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Standard procurement terms are used with no security schedule for high-risk suppliers
- The right to audit or to receive assurance reports is missing from critical contracts
- No register of agreements exists, so the organization cannot say which parties hold its information
- Subcontracting clauses do not flow security obligations down to sub-suppliers
How it maps to SOC 2
- CC2.3 high Supplier agreements communicate security expectations to external parties.
- CC9.2 high Security requirements in supplier agreements bind vendor controls.
- P6.4 low Requires supplier agreements to address information security, including privacy commitments.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.