ISO 27001 Annex A 5.20 Integrating security clauses in supplier agreements

This control partially overlaps A.10.2.

Annex A 10.2 requires clear allocation of responsibilities across the AI system life cycle, including with suppliers and other third parties. Annex A 5.20 supports this by requiring security requirements to be established and agreed in supplier agreements, which is a practical mechanism for documenting and enforcing who is responsible for which controls and tasks. Annex A 5.20 is limited to supplier agreements and information security requirements, whereas Annex A 10.2 spans broader AI life-cycle responsibilities (including non-security responsibilities) across more stakeholder types.

This control partially overlaps A.10.3.

Annex A 10.3 requires supplier arrangements that ensure third-party inputs used for AI align with responsible AI development and use. ISO/IEC 27001:2022 Annex A 5.20 overlaps by requiring information security requirements to be agreed in supplier contracts, which is a key mechanism to impose AI-related security clauses (e.g., vulnerability disclosure, logging, data handling, access controls). Annex A 5.20 is security-clause focused, while Annex A 10.3 also requires responsible-AI clauses such as transparency, safety testing, human oversight support and acceptable-use restrictions.

This control is equivalent to ISM-0072.

Annex A 5.20 requires information security requirements to be agreed with each supplier. ISM-0072 matches this by mandating documentation of confidentiality, integrity, and availability requirements in contracts, reviewed regularly.

This control is broader than ISM-0141.

ISM-0141 requires supplier agreements to explicitly include prompt cyber incident reporting to a designated contact. ISO/IEC 27001:2022 Annex A 5.20 is broader, requiring that relevant information security requirements are established and agreed with each supplier, which would typically include incident reporting obligations and notification timeframes. ISM-0141 is a specific clause-level requirement that can be implemented as part of Annex A 5.20's supplier agreement security clauses.

This control is broader than ISM-1451.

ISM-1451 requires organisations to document data types and ownership in service provider contracts. This is a distinct requirement that fits under ISO/IEC 27001:2022 Annex A 5.20's broader expectation to include security requirements in supplier agreements, such as access controls and incident notification.

This control is broader than ISM-1571.

ISM-1571 requires that service provider contracts explicitly document the organisation's right to verify the provider's compliance with security requirements. Annex A 5.20 requires relevant information security requirements to be established and agreed within supplier agreements, which commonly includes audit, attestation and compliance verification clauses. Annex A 5.20 is broader because it covers establishing all relevant supplier security clauses, whereas ISM-1571 focuses specifically on the right to verify compliance.

This control is broader than ISM-1572.

ISM-1572 requires explicit supplier contract terms for data handling locations (regions/availability zones) and minimum advance notice for configuration changes. ISO/IEC 27001:2022 Annex A 5.20 directly relates by requiring relevant information security requirements to be established and agreed with each supplier, typically implemented via security clauses covering data residency and change management notifications. Annex A 5.20 is broader because it covers all relevant supplier security requirements, whereas ISM-1572 is a specific minimum set of clauses to include.

This control is broader than ISM-1575.

ISM-1575 requires contracts with service providers to include a documented minimum one-month notice period before services can be terminated. This directly aligns with ISO/IEC 27001:2022 Annex A 5.20, which requires integrating relevant information security requirements as clauses within supplier agreements. Annex A 5.20 is broader because it covers all security clauses (e.g. access, incident notification, audit rights), whereas ISM-1575 specifies one particular contractual clause about termination notice.

This control is broader than ISM-1794.

ISM-1794 requires organisations to document a minimum one-month notification period for significant supplier-side arrangement changes within contracts. ISO/IEC 27001:2022 Annex A 5.20 relates because it requires integrating relevant information security requirements into supplier agreements, which is the mechanism used to mandate advance change notification. ISM-1794 is one particular clause requirement (time-bound change notification), whereas Annex A 5.20 covers establishing and agreeing a wider set of security clauses appropriate to the supplier relationship.

This control is broader than ISM-1804.

Annex A 5.20 requires organisations to agree on information security requirements with suppliers. ISM-1804 is narrower, specifying break clauses as a contractual mechanism for cloud service providers to enforce consequences when security requirements are unmet.

This control partially meets ISM-1738.

Annex A 5.20 requires relevant information security requirements to be established and agreed with each supplier based on the relationship type. ISM-1738 mandates regular verification of a service provider's compliance with these requirements, making it narrower as it focuses on ongoing compliance verification rather than establishing initial requirements.

This control partially meets ISM-1786.

ISM-1786 requires an organisation to maintain an approved supplier list to control which suppliers can be engaged. ISO/IEC 27001:2022 Annex A 5.20 focuses on agreeing and embedding security requirements in supplier agreements, which is broader contract governance across all supplier relationships. An approved supplier list (ISM-1786) supports applying consistent contractual clauses, but Annex A 5.20 extends well beyond listing suppliers to the content and enforcement of contractual security requirements.

This control partially overlaps ISM-1178.

ISM-1178 requires limiting the amount of network documentation shared with third parties to what is necessary for contractual services. Annex A 5.20 requires integrating information security requirements into supplier agreements, which can include contractual constraints on what network information is requested, provided, used and re-disclosed. The overlap is in controlling third-party disclosure via contractual mechanisms, but ISM-1178 is specifically about content minimisation of network documentation, while Annex A 5.20 is about embedding a wider set of security clauses across the supplier lifecycle.

This control partially overlaps ISM-1568.

ISM-1568 requires organisations to buy IT/OT products and services only from suppliers that can demonstrate a commitment to security. Annex A 5.20 focuses on establishing and agreeing information security requirements in supplier agreements, which is a common mechanism to evidence and enforce that supplier commitment. ISM-1568 emphasises supplier selection/assurance evidence at procurement, whereas Annex A 5.20 emphasises contractualising requirements (which can apply even where the supplier's inherent commitment is uncertain).

This control partially overlaps ISM-1569.

Annex A 5.20 involves establishing and agreeing on information security requirements with suppliers. ISM-1569 overlaps by requiring a documented shared responsibility model for security responsibilities, typically part of supplier agreements.

This control partially overlaps ISM-1737.

ISM-1737 requires recording contractual arrangements as part of a service register. This overlaps with ISO/IEC 27001:2022 Annex A 5.20, as both address supplier agreements. ISM-1737 ensures contract information is traceable, while Annex A 5.20 requires integrating security clauses into agreements.

This control partially overlaps ISM-1882.

ISM-1882 requires organisations to select suppliers that have demonstrated transparency about their products and services before procurement. Annex A 5.20 focuses on integrating relevant information security requirements into supplier agreements, which can include contractual obligations for transparency (e.g., disclosure of vulnerabilities, SBOMs, audit rights, incident notification). They overlap where transparency expectations are formalised contractually, but ISM-1882 also concerns supplier selection and evidence of transparency even prior to contract execution.

This control supports ISM-1576.

ISM-1576 requires service-provider unauthorised access/administration to be treated as an incident and for the organisation to be notified immediately. ISO/IEC 27001:2022 Annex A 5.20 is a prerequisite because embedding security clauses in supplier agreements is typically how you legally and operationally require providers to notify you promptly and to classify unauthorised access as an incident. ISM-1576 is the behavioural/response expectation, whereas Annex A 5.20 is the contracting mechanism that makes it enforceable and measurable.

This control supports ISM-1785.

ISM-1785 requires an organisation to establish and maintain a supplier relationship management policy. Annex A 5.20 supports ISM-1785 by specifying that information security requirements must be established and agreed with each supplier via security clauses in supplier agreements, which is a common policy requirement and implementation mechanism. ISM-1785 is broader at the policy level, whereas Annex A 5.20 is a specific contractual control focusing on agreed security requirements per supplier.

This control depends on ISM-1395.

ISM-1395 requires service providers and subcontractors to protect any data entrusted to them or their services at an appropriate level. Annex A 5.20 supports this by requiring security requirements and clauses to be established and agreed in supplier agreements, which is a primary mechanism for mandating the expected protection level from providers. Annex A 5.20 is about contractual specification, while ISM-1395 is about the resulting protection outcome being achieved by the provider.

This control depends on ISM-1631.

ISM-1631 requires organisations to identify suppliers linked to operating systems, applications, IT/OT equipment and services associated with systems. ISO/IEC 27001:2022 Annex A 5.20 requires establishing and agreeing security requirements with each supplier in agreements, which presupposes the organisation has identified those suppliers. ISM-1631 does not address contractual clauses, but it provides the necessary supplier list to apply Annex A 5.20 consistently.

This control depends on ISM-1793.

ISM-1793 requires periodic IRAP assessments of managed service providers against the ISM to maintain assurance over their security compliance. Annex A 5.20 requires agreeing relevant information security requirements with each supplier in contractual arrangements, and IRAP/ISM expectations are commonly flowed down as contractual obligations and acceptance criteria. ISM-1793 focuses on assurance via independent assessment, whereas Annex A 5.20 focuses on establishing the contractual requirements that can then be assessed.

This control partially overlaps IT.GOV-11.1.

IT.GOV-11.1 requires suppliers to be selected and engaged on the basis of a cyber supply chain risk assessment proportionate to the risk each supplier introduces. That assessment provides the basis for ISO/IEC 27001 Annex A 5.20, which requires relevant information security requirements to be established and agreed with each supplier according to the type of supplier relationship. IT.GOV-11.1 covers the risk-based selection decision and retention of assurance evidence, while Annex A 5.20 covers agreeing the resulting security requirements with the supplier.

This control supports IT.GOV-11.2.

IT.GOV-11.2 requires the organisation to maintain current assurance that suppliers continue to meet their cyber security commitments and to act when that assurance lapses. Those commitments must first be set, and ISO/IEC 27001 Annex A 5.20 is the control that establishes and agrees relevant information security requirements with each supplier. IT.GOV-11.2 therefore depends on Annex A 5.20, which addresses setting the requirements rather than assuring continued compliance with them.