ISO 27001 Annex A 5.19 Managing information security in supplier relationships

This control partially overlaps A.10.2.

Annex A 10.2 requires the organisation to allocate responsibilities across the AI system life cycle among internal and external parties. Annex A 5.19 supports this by requiring defined processes and procedures to manage information security risks in supplier relationships, which typically includes assigning accountability (e.g., who monitors, who approves, who remediates) across parties. Annex A 5.19 is supplier-relationship and risk-management focused, while Annex A 10.2 is broader and explicitly about responsibility allocation across the whole AI life cycle and multiple third-party types.

This control partially overlaps A.10.3.

Annex A 10.3 requires a supplier management process ensuring external inputs used in AI align with responsible AI development and use. ISO/IEC 27001:2022 Annex A 5.19 overlaps by requiring processes to manage information security risks in supplier relationships, which applies to third-party data, models, platforms and managed services used in AI. Annex A 5.19 is confined to information security risk, whereas Annex A 10.3 extends supplier management to responsible AI outcomes beyond CIA (e.g., safety, transparency and appropriate use).

This control is broader than ISM-0141.

ISM-0141 requires a specific supplier-relationship outcome: service provider contracts must document prompt cyber incident reporting to a designated contact. ISO/IEC 27001:2022 Annex A 5.19 is broader, requiring processes and procedures to manage information security risks across supplier relationships, which commonly includes incident notification and escalation expectations. ISM-0141 is a concrete contractual requirement that fits within the wider supplier security management framework of Annex A 5.19.

This control is broader than ISM-0280.

ISM-0280 requires organisations to select PP-evaluated products in preference to EAL-evaluated products when procuring evaluated products. Annex A 5.19 addresses managing information security risks in supplier relationships more generally, including requirements placed on supplier products and services. ISM-0280 fits as a specific supplier/product assurance selection rule within the wider supplier-relationship management control in Annex A 5.19.

This control is broader than ISM-0285.

ISM-0285 mandates delivery of evaluated products consistent with evaluator-defined procedures. ISO/IEC 27001:2022 Annex A 5.19 requires processes to manage information security risks with suppliers, including delivery and chain-of-custody controls. ISM-0285 is focused on specific evaluated-product procedures, while Annex A 5.19 covers broader supplier risks.

This control is broader than ISM-0840.

ISM-0840 mandates use of a certified third-party destruction service for outsourced destruction of media storing non-accountable material. Annex A 5.19 requires managing information security risks in supplier relationships generally, including setting requirements and controls for suppliers delivering services. ISM-0840 is a specific supplier control focused on secure media destruction certification, while Annex A 5.19 covers a wider range of supplier types, risks, and lifecycle management activities.

This control is broader than ISM-1073.

ISM-1073 mandates that service providers can access or administer organisational systems only when a contractual agreement is in place. ISO/IEC 27001:2022 Annex A 5.19 covers managing security risks associated with supplier relationships, which encompasses but is broader than ISM-1073's requirement for contracts before access.

This control is broader than ISM-1178.

ISM-1178 requires that network documentation provided to third parties is restricted to the minimum necessary for contractual delivery. Annex A 5.19 requires processes and procedures to manage information security risks arising from supplier relationships, which would typically include controlling what internal technical information (such as network diagrams and addressing) is disclosed to suppliers. ISM-1178 strengthens supplier risk management by reducing the impact of over-disclosure, but Annex A 5.19 also covers broader supplier governance beyond documentation content.

This control is broader than ISM-1451.

ISM-1451 ensures data types and ownership are clearly documented in service contracts. This specific contractual control supports the broader goal of Annex A 5.19 to manage supplier risk through defined processes, including clarifying data ownership.

This control is broader than ISM-1452.

ISM-1452 requires organisations to perform supply chain risk assessments across suppliers of operating systems, applications, IT/OT equipment and services to determine impacts to the system's security risk profile. Annex A 5.19 requires processes and procedures to manage information security risks in supplier relationships, under which supplier risk assessment is a core method. ISM-1452 is therefore a specific requirement within the broader supplier-relationship risk management expectations of Annex A 5.19.

This control is broader than ISM-1567.

ISM-1567 requires organisations to avoid using suppliers that have been assessed as high risk in the cyber supply chain. ISO/IEC 27001:2022 Annex A 5.19 requires processes and procedures to manage information security risks arising from supplier products and services, which includes assessment, selection, and ongoing governance of suppliers. ISM-1567 maps to one specific outcome of supplier risk management (excluding high-risk suppliers), while Annex A 5.19 covers a broader range of risk treatments and relationship management activities.

This control is broader than ISM-1568.

Annex A 5.19 requires processes and procedures to manage information security risks associated with suppliers' products and services. ISM-1568 relates by requiring procurement from suppliers who demonstrate a commitment to the security of their products and services, which is one risk treatment approach within supplier management. ISM-1568 is focused on supplier selection and procurement criteria, whereas Annex A 5.19 covers the full supplier relationship lifecycle, including ongoing assurance and management.

This control is broader than ISM-1572.

ISM-1572 requires contractual arrangements with service providers to document the regions/availability zones where data is processed, stored and communicated, and to specify a minimum notification period for configuration changes. ISO/IEC 27001:2022 Annex A 5.19 relates by requiring defined and implemented processes to manage information security risks arising from supplier products or services, which commonly includes contracting for data residency and change notification. Annex A 5.19 is broader across supplier risk management, while ISM-1572 is a specific contractual requirement focused on data location transparency and advance notice of provider changes.

This control is broader than ISM-1573.

ISM-1573 requires contracts with service providers to document how the organisation can access all logs relating to its data and services. Annex A 5.19 requires processes and procedures to manage information security risks in supplier relationships, which typically includes defining security obligations, auditability, monitoring, and access to relevant security evidence. ISM-1573 is a specific supplier-contract requirement focused on log access, making it a concrete subset of the broader supplier relationship security management expected by Annex A 5.19.

This control is broader than ISM-1574.

ISM-1574 requires organisations to document data portability expectations (backup, migration, and decommissioning without data loss) in contracts with service providers. Annex A 5.19 requires establishing processes to manage information security risks in supplier relationships, which includes identifying and managing risks of vendor lock-in, poor exit processes, and loss of data during migration. Annex A 5.19 is broader supplier security governance, while ISM-1574 is a specific contractual requirement covering portability and exit outcomes.

This control is broader than ISM-1575.

ISM-1575 requires a documented minimum one-month notification period for a supplier to cease services, written into service provider contracts. This relates to ISO/IEC 27001:2022 Annex A 5.19 because exit and continuity risks from suppliers (including termination conditions) are part of managing supplier-related information security risks. Annex A 5.19 is broader, covering the overall supplier risk management framework beyond termination notice periods.

This control is broader than ISM-1631.

Annex A 5.19 requires organisations to manage information security risks associated with using supplier products or services through defined processes and procedures. ISM-1631 supports this by requiring organisations to identify relevant suppliers in the cyber supply chain, which is a foundational input to assessing and managing those risks. ISM-1631 is limited to identification, while Annex A 5.19 extends to risk treatment, controls, and ongoing management across the supplier relationship lifecycle.

This control is broader than ISM-1632.

ISM-1632 requires organisations to procure operating systems, applications, equipment and services from suppliers with a strong track record of securing their own systems. Annex A 5.19 requires defining and implementing processes to manage information security risks across supplier relationships, which includes due diligence and supplier selection activities that would encompass choosing reputable, secure suppliers. ISM-1632 is a specific supplier-selection expectation, whereas Annex A 5.19 is broader across the full supplier relationship lifecycle (selection, onboarding, ongoing management and offboarding).

This control is broader than ISM-1637.

ISM-1637 requires an organisation to maintain and regularly verify a register of outsourced cloud services. This supports ISO/IEC 27001:2022 Annex A 5.19 because managing information security risks in supplier relationships is more effective when the organisation has an authoritative list of all cloud suppliers/services and can identify where data and processing occur. Annex A 5.19 is broader (risk treatment, governance, and controls across supplier relationships), while ISM-1637 is a foundational inventory requirement specific to cloud outsourcing.

This control is broader than ISM-1786.

ISM-1786 requires an organisation to develop, implement and maintain an approved supplier list. ISO/IEC 27001:2022 Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, which typically includes identifying/approving suppliers and maintaining visibility of who is permitted to provide products or services. ISM-1786 is a specific governance mechanism within the broader supplier risk management processes required by Annex A 5.19.

This control is broader than ISM-1787.

ISM-1787 requires that operating systems, applications, IT/OT equipment and services are sourced only from approved suppliers. This is a specific supplier-selection measure that fits within Annex A 5.19, which requires organisations to define and implement processes to manage information security risks when using supplier products or services. Annex A 5.19 is broader because it also covers risk management across the supplier relationship lifecycle, not just procurement restrictions.

This control is broader than ISM-1788.

ISM-1788 requires organisations to identify multiple potential suppliers for critical operating systems, applications, IT/OT equipment, and services to reduce supply chain risk and dependency. Annex A 5.19 requires defining and implementing processes to manage information security risks in supplier relationships, within which maintaining alternate/contingency suppliers is a common risk treatment for critical dependencies. ISM-1788 is a specific supply resilience measure, whereas Annex A 5.19 is broader and covers the full lifecycle of supplier relationship security governance beyond supplier plurality.

This control is broader than ISM-1789.

ISM-1789 necessitates verifying the authenticity of software, hardware, and services prior to their supply chain acceptance. ISO/IEC 27001:2022 Annex A 5.19 mandates broader processes to manage risks associated with supplier products/services, which could include authenticity checks. Annex A 5.19 is broader, addressing a wide spectrum of supplier relationship risks, compared to ISM-1789's specific focus on supply chain acceptance.

This control is broader than ISM-1790.

ISM-1790 focuses on ensuring IT/OT deliveries arrive without tampering and with integrity preserved. Annex A 5.19 requires processes to manage information security risks in supplier relationships generally, which can include requirements for secure packaging, chain-of-custody and acceptance checks. The ISO control is broader because it covers the full supplier relationship lifecycle and multiple risk types, while ISM-1790 concentrates on the delivery integrity aspect.

This control is broader than ISM-1791.

ISM-1791 requires organisations to assess the integrity of delivered IT/OT operating systems, applications, equipment and services as part of acceptance. Annex A 5.19 requires defining and implementing processes to manage information security risks in supplier relationships, which includes setting acceptance criteria and verification activities such as integrity checking. Annex A 5.19 is broader across the whole supplier relationship lifecycle, whereas ISM-1791 is focused specifically on integrity assessment at delivery/acceptance.

This control is broader than ISM-1793.

ISM-1793 requires managed service providers (and their managed services up to SECRET) to undergo an IRAP assessment against the latest ISM at least every 24 months. Annex A 5.19 requires organisations to define and implement processes to manage information security risks arising from supplier products and services, which is strengthened by obtaining independent assurance (e.g. IRAP) over a provider's control environment. ISM-1793 is more specific (Australian Government IRAP/ISM cadence and classification scope), while Annex A 5.19 is broader supplier-risk governance without prescribing IRAP or a reassessment interval.

This control is broader than ISM-1794.

ISM-1794 requires contractual terms that compel service providers to give at least one month's notice before significant changes to their own service provider arrangements. ISO/IEC 27001:2022 Annex A 5.19 relates by requiring defined processes to manage information security risks in supplier relationships, which commonly includes managing and being notified of supplier changes that could affect risk. ISM-1794 is a specific contractual notification requirement, while Annex A 5.19 is broader and covers the overall supplier risk management lifecycle beyond notice periods.

This control is broader than ISM-1804.

ISM-1804 relates to contractual break clauses for cloud service security non-compliance. ISO/IEC 27001:2022 Annex A 5.19 discusses managing information security risks across supplier relationships, including contracting and enforcement. Annex A 5.19 is broader as it pertains to comprehensive supplier risk management, beyond ISM-1804's specific focus.

This control is broader than ISM-1826.

ISM-1826 requires organisations to choose server vendors that demonstrate commitment to Secure by Design and secure programming practices (preferably memory-safe languages). Annex A 5.19 requires processes and procedures to manage information security risks arising from supplier products and services generally. ISM-1826 fits within supplier relationship risk management but is narrower and more prescriptive about secure design evidence specifically for server applications.

This control is broader than ISM-1882.

ISM-1882 requires organisations to procure operating systems, applications, IT/OT equipment and services only from suppliers that have demonstrated a commitment to transparency about their products and services. Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, within which "transparent supplier selection" is a specific risk treatment and due diligence criterion. Annex A 5.19 is broader because it covers the full supplier relationship risk lifecycle (selection, onboarding, management, offboarding), whereas ISM-1882 focuses specifically on transparency at procurement time.

This control is broader than ISM-2082.

ISM-2082 requires using a CBOM for imported third-party components during development to validate cryptographic support aligns with ASD‑Approved Cryptographic Algorithms. ISO/IEC 27001:2022 Annex A 5.19 requires processes to manage information security risks arising from supplier products and services, including security requirements and assurance for third-party deliverables. ISM-2082 is a specific control for one class of supplier risk (non-standard or weak cryptography), while Annex A 5.19 covers the full range of supplier relationship risks and controls.

This control partially meets ISM-0731.

ISM-0731 requires the CISO to oversee the organisation's cyber supply chain risk management activities. Annex A 5.19 mandates defined and implemented processes to manage information security risks in supplier relationships, which is a core component the CISO would oversee under ISM-0731. Annex A 5.19 focuses on operational supplier-risk processes, while ISM-0731 is a governance/oversight accountability requirement rather than the detailed process design itself.

This control partially meets ISM-1571.

ISM-1571 requires contractual arrangements to include the right for the organisation to verify a service provider's compliance with security requirements. Annex A 5.19 requires defined processes and procedures to manage information security risks in supplier relationships, which typically rely on contractual rights (e.g. audit/assessment rights) to execute assurance activities. Annex A 5.19 is broader because it covers end-to-end supplier risk management beyond contract wording, while ISM-1571 is a specific contractual assurance requirement.

This control partially overlaps ISM-0072.

Annex A 5.19 requires organisations to define and implement processes to manage information security risks arising from supplier products and services. ISM-0072 relates by mandating that confidentiality, integrity, and availability security requirements are documented in service provider contracts and reviewed regularly, a key mechanism for managing supplier risk. ISM-0072 is contract-specific, whereas Annex A 5.19 is broader, including due diligence, monitoring, assurance activities, and governance beyond contractual terms.

This control partially overlaps ISM-0307.

ISM-0307 requires sanitising equipment and media before maintenance when an appropriately cleared technician is not used. Annex A 5.19 establishes processes to manage information security risks in supplier relationships, providing the governance mechanism to require and verify sanitisation arrangements for suppliers or their staff. The implementation of ISM-0307 often relies on such governance.

This control partially overlaps ISM-1395.

ISM-1395 requires that service providers (and subcontractors) provide an appropriate level of protection for entrusted data. Annex A 5.19 overlaps by requiring defined processes and procedures to manage information security risks arising from supplier products or services, which is the governance mechanism used to ensure providers protect entrusted information. Annex A 5.19 is broader in supplier-risk process coverage (risk management across supplier use), whereas ISM-1395 is specifically focused on the protection level applied to entrusted data.

This control partially overlaps ISM-1569.

ISM-1569 requires a documented and shared shared-responsibility model between supplier and customer to clearly assign security responsibilities. ISO/IEC 27001:2022 Annex A 5.19 requires defined processes and procedures to manage information security risks in supplier relationships, which commonly includes clarifying who does what across the engagement. Annex A 5.19 is broader around supplier risk management overall, while ISM-1569 is more specific on mutual documentation and communication of responsibility boundaries.

This control partially overlaps ISM-1570.

ISM-1570 mandates periodic IRAP assessments for outsourced cloud service providers handling non-classified and classified data up to SECRET, providing formal assurance of cloud security posture. Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, and an IRAP report is a concrete input to those supplier risk processes. Annex A 5.19 covers the full lifecycle of supplier risk treatment (e.g. selection, contracting, ongoing controls), whereas ISM-1570 focuses specifically on independent assessment cadence and benchmark (ISM) for cloud services.

This control partially overlaps ISM-1576.

ISM-1576 requires that if a service provider accesses or administers an organisation's systems in an unauthorised manner, the organisation is immediately notified. Annex A 5.19 requires processes to manage information security risks in supplier relationships, which commonly includes contractual and operational requirements for supplier incident/event notification. Annex A 5.19 is broader (covers many supplier risk controls beyond notification), while ISM-1576 is narrower and more specific about unauthorised access/admin and immediate notification.

This control partially overlaps ISM-1738.

ISM-1738 mandates regular verification of service provider compliance with contracted security requirements. ISO/IEC 27001:2022 Annex A 5.19 involves managing information security risks in supplier relationships, including assurance activities. While Annex A 5.19 is about broader risk management, it aligns with ISM-1738's focus on ongoing compliance verification.

This control partially overlaps ISM-1785.

Annex A 5.19 requires defined and implemented processes and procedures to manage information security risks from suppliers' products and services. ISM-1785 relates by requiring a supplier relationship management policy to be developed, implemented, and maintained, providing governance and structure for managing supplier security. ISM-1785 is policy-centric, while Annex A 5.19 emphasises operational processes, procedures, and risk management outcomes.

This control partially overlaps ISM-1972.

ISM-1972 requires outsourced TOP SECRET cloud service providers (including SCI cloud services) to undergo an ASD assessor (or delegate) security assessment against the latest ISM at least every 24 months. ISO/IEC 27001:2022 Annex A 5.19 requires the organisation to define and implement processes to manage information security risks in supplier relationships, which commonly includes contractual assurance, third-party audits/assessments, and periodic reviews for high-risk suppliers such as cloud providers. There is overlap as ISM-1972 specifies a supplier-assurance mechanism within the broader expectations of Annex A 5.19.

This control supports ISM-1480.

ISM-1480 requires evaluated peripheral switches that bridge SECRET/TOP SECRET and lower classifications to undergo a high assurance evaluation. Annex A 5.19 supports this by requiring the organisation to manage supplier/product security risk, ensuring the selected peripheral switch has appropriate independent assurance (e.g., certified evaluation) and trustworthy supply chain. However, Annex A 5.19 is broader across all supplier relationships and does not specifically mandate high assurance evaluation for cross-domain peripheral switches like ISM-1480 does.

This control supports ISM-1577.

ISM-1577 requires an organisation's networks to be segregated from their service providers' networks as a concrete technical risk treatment for third-party connectivity. ISO/IEC 27001:2022 Annex A 5.19 requires processes to manage information security risks in supplier relationships, under which network segregation is a common control expectation for connected suppliers. Annex A 5.19 is governance and lifecycle focused, while ISM-1577 is a specific technical architecture outcome for supplier network separation.

This control supports ISM-1638.

ISM-1638 requires maintaining a comprehensive register of outsourced cloud services, including purpose, data sensitivity/classification, contractual arrangements, assessment due dates, and contacts. Annex A 5.19 requires defined processes and procedures to manage information security risks in supplier relationships, and a cloud service register is a practical input that supports identifying, tracking, and governing those supplier risks. Annex A 5.19 is broader (covers all suppliers and risk processes), while ISM-1638 is a specific record-keeping/control artefact focused on cloud outsourcing details.

This control supports ISM-1736.

ISM-1736 requires organisations to maintain a current, verified register of managed services. This supports ISO/IEC 27001:2022 Annex A 5.19 because managing information security risks in supplier relationships requires visibility of which supplier services exist, their owners, and their scope. Annex A 5.19 is broader and covers end-to-end supplier relationship controls (e.g. requirements, governance, assurance), while ISM-1736 primarily ensures the register exists and is kept accurate.

This control supports ISM-1737.

ISM-1737 requires organisations to maintain a comprehensive managed service register capturing provider details, purpose, data sensitivity/classification, assessment due dates, contractual arrangements and support contacts. Annex A 5.19 requires defined processes to manage information security risks arising from supplier products or services, and a managed service register provides the visibility and accountability needed to apply those processes consistently across suppliers. Annex A 5.19 is broader (risk management processes), while ISM-1737 is a specific governance artefact focused on recording key supplier/service attributes.

This control supports ISM-2027.

ISM-2027 requires cryptographic integrity/authenticity checks (signatures or secure hashes via a secure channel) for software artefacts prior to import. This supports Annex A 5.19 by providing a practical technical measure to manage risks in supplier relationships when consuming supplier-provided software or updates. Annex A 5.19 is wider in scope, covering governance of supplier controls and assurance activities that extend well beyond software artefact verification.

This control is broader than IT.GOV-11.1.

IT.GOV-11.1 requires suppliers of software, hardware and services to be selected and engaged on the basis of a proportionate cyber supply chain risk assessment, with assurance evidence retained to support the decision. Risk-based supplier selection is a specific part of the processes ISO/IEC 27001 Annex A 5.19 requires to manage information security risks from the use of suppliers' products or services. Annex A 5.19 covers the whole supplier relationship, whereas IT.GOV-11.1 addresses the selection and engagement stage.

This control is broader than IT.GOV-11.2.

IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when that assurance lapses or the supplier's risk changes. This is a specific part of the supplier risk management processes that ISO/IEC 27001 Annex A 5.19 requires for the use of suppliers' products or services. Annex A 5.19 covers the full supplier relationship, while IT.GOV-11.2 addresses only the ongoing assurance stage.