ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain
What it says
Processes and procedures shall be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure ICT supply chain security by managing risks with processes and procedures.
This control is about making sure the technology products and services you get from your suppliers are secure. If someone in the chain is sloppy or lacks security, it could lead to problems like data breaches, service disruptions, or financial loss. Think of it like ensuring your house is built with quality materials: if one part is weak, the whole structure could be compromised.
Free. Save your status, tasks and notes.
Why it matters
Weak ICT supply chain security can lead to data breaches or disruptions as insecure supply chain links provide attackers a backdoor into your organisation.
How to implement
The procurement team should define clear security requirements when purchasing any ICT products or services.
They should ensure suppliers know exactly what security measures need to be in place, such as data protection and system integrity, and include these details in contracts.
An IT manager should ensure that all suppliers are required to apply the organisation's security practices throughout their own supply chains.
This includes asking for a list of their critical components and verifying how they ensure these components are secure.
The IT security officer should set up a process to regularly review and monitor suppliers' compliance with security requirements.
This could involve routine checks like penetration tests or reviewing third-party security assessments.
A project manager should be tasked with identifying all critical components of each ICT product or service.
They should maintain an updated list and ensure any changes or updates from the supplier do not introduce risks.
Executives should ensure there is a plan for what happens if a main supplier can no longer provide a product or service.
This includes finding alternative suppliers and making sure knowledge and data can be transferred without issues.
Keep it running
Regularly assess supplier security practices, contracts and access; track vendor vulnerabilities and updates to manage ICT supply chain risks.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the security requirements documentation provided to ICT suppliers.
Look at
Check if the security requirements cover confidentiality, integrity, and availability of information.
Good evidence
Documents are comprehensive and included in supplier contracts, ensuring clear expectations.
- Check 2 of 5What an auditor asks for
Ask for
Obtain the list of suppliers with their compliance evidence for security practices.
Look at
Verify if the suppliers have third-party security attestations or certifications.
Good evidence
All suppliers have up-to-date compliance certificates or equivalent security validations.
- Check 3 of 5What an auditor asks for
Ask for
Review the monitoring and validation reports for supplier compliance.
Look at
Look for records of regular checks, tests, or audits conducted on the supplier's products.
Good evidence
Reports show regular and documented security checks with suppliers meeting all set requirements.
- Check 4 of 5What an auditor asks for
Ask for
Request the list of critical components identified in ICT products or services.
Look at
Check if there are documented details about each component's significance and security status.
Good evidence
The list is comprehensive and updated regularly with all critical components adequately protected.
- Check 5 of 5What an auditor asks for
Ask for
Examine the supplier continuity and alternative plans.
Look at
Verify if there's a risk management plan outlining alternative suppliers and a transfer process.
Good evidence
Plans are detailed with clear procedures for transitioning to alternative suppliers without disruption.
Mappings
Closest match in ASD Information Security Manual: ISM-1452, Perform supply chain risk assessments for system suppliers, which asks for the same thing.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires a supplier process ensuring third-party inputs used for AI align with responsible AI development and use. ISO/IEC 27001:2022 Annex A 5.21 overlaps by requiring processes to manage information security risks in the ICT supply chain, covering many AI dependencies such as cloud infrastructure, MLOps tooling, third-party model components and data pipelines. Annex A 5.21 is information-security scoped, while Annex A 10.3 extends supplier governance to responsible-AI concerns such as transparency, safety and misuse controls.
ASD Information Security Manual: 48 mappings
This control is equivalent to ISM-1452.
ISM-1452 requires a supply chain risk assessment for suppliers of operating systems, applications, IT/OT equipment and services to determine the impact on a system's security risk profile. Annex A 5.21 requires defined and implemented processes to manage information security risks in the ICT products and services supply chain, which directly aligns with performing and using supply chain risk assessments. ISM-1452 is explicit about assessing supplier impact to a system's risk profile (including OT), while Annex A 5.21 is framed more generally around managing ICT supply chain risk via processes and procedures.
This control is broader than ISM-0280.
ISM-0280 requires organisations to prefer procuring products that have completed Protection Profile (PP)-based evaluations (including applicable PP modules and SBOM assessment where relevant) over EAL-based evaluations. Annex A 5.21 requires defining and implementing processes to manage ICT supply chain security risks, which can include setting assurance requirements for procured products. ISM-0280 is a specific procurement assurance criterion within the broader supply-chain risk management expectations of Annex A 5.21.
This control is broader than ISM-0285.
ISM-0285 requires evaluated products to be delivered in accordance with delivery procedures specified in evaluation documentation. ISO/IEC 27001:2022 Annex A 5.21 is broader, covering management of information security risks across the ICT supply chain, such as secure fulfilment and shipping, applicable to all ICT supply chain relationships.
This control is broader than ISM-0731.
ISM-0731 requires the CISO to oversee cyber supply chain risk management activities for their organisation. Annex A 5.21 requires defined and implemented processes to manage information security risks associated with the ICT products and services supply chain, which is directly within the cyber supply chain scope the CISO oversees under ISM-0731. Annex A 5.21 specifies the need for supply-chain risk processes, whereas ISM-0731 specifies executive oversight and accountability rather than process detail.
This control is broader than ISM-0840.
ISM-0840 requires that when an organisation outsources destruction of media holding non-accountable material, it uses a specifically certified destruction provider (NAID AAA with required endorsements per PSC-167). Annex A 5.21 requires defining and implementing processes to manage information security risks across the ICT products and services supply chain, which includes due diligence and controls over outsourced service providers. ISM-0840 is a prescriptive, single-use supply-chain requirement for media destruction, whereas Annex A 5.21 is broader across all ICT supply chain risks.
This control is broader than ISM-0938.
ISM-0938 focuses on choosing vendors for user applications who demonstrate Secure by Design/Secure by Default practices. ISO/IEC 27001:2022 Annex A 5.21 covers managing information security risks in the ICT supply chain, including setting supplier security expectations. Annex A 5.21 spans broader ICT supply chain risks, while ISM-0938 is application-specific.
This control is broader than ISM-1395.
Annex A 5.21 requires defined processes to manage information security risks arising from ICT supply chain products and services. ISM-1395 relates by setting an explicit expectation that service providers (and subcontractors) protect data entrusted to them, which is a core supplier assurance requirement within supply chain risk management. Annex A 5.21 is broader because it covers a wider range of ICT supply chain risks (e.g. product integrity, continuity, authenticity, and monitoring), not only data protection obligations for service providers.
This control is broader than ISM-1567.
Annex A 5.21 requires defined processes and procedures to manage information security risks arising from ICT supply chain products and services. ISM-1567 is a specific risk treatment outcome within that process: excluding suppliers deemed high risk by a cyber supply chain risk assessment. Annex A 5.21 is broader as it includes how risks are identified, assessed, monitored and contractually managed, whereas ISM-1567 focuses on a single selection decision rule.
This control is broader than ISM-1568.
ISM-1568 requires organisations to procure operating systems, applications, IT/OT equipment and services from suppliers that have demonstrated a commitment to security. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, including upstream dependencies, sub-suppliers, component integrity and broader supply chain assurance. ISM-1568 fits within this larger supply chain risk management concept, but is narrower because it focuses on supplier security commitment at procurement rather than end-to-end ICT supply chain risk.
This control is broader than ISM-1632.
ISM-1632 requires organisations to procure ICT/OT products and services from suppliers with a proven ability to maintain the security of their own systems. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, which includes supplier evaluation, assurance, monitoring, and handling of supply chain threats. ISM-1632 is one concrete supply-chain risk treatment (choosing reliable suppliers), while Annex A 5.21 has broader supply chain scope including upstream components, logistics, and systemic supply chain controls.
This control is broader than ISM-1737.
Annex A 5.21 requires defined processes and procedures to manage information security risks associated with ICT supply chain products and services. ISM-1737 relates by mandating a managed service register with provider details, data sensitivity/classification, contract arrangements and assessment due dates, which is foundational for identifying and governing service-supply-chain exposures. Annex A 5.21 is broader because it includes the risk management activities themselves (assessment, controls, monitoring and remediation), whereas ISM-1737 is primarily an inventory and governance record-keeping requirement.
This control is broader than ISM-1743.
ISM-1743 requires organisations to choose operating system vendors that demonstrate Secure by Design/Secure by Default practices and prefer memory-safe languages or practices. ISO/IEC 27001:2022 Annex A 5.21 requires managing information security risks across the broader ICT supply chain, which includes selecting and assuring vendors for ICT products such as operating systems. ISM-1743 is a specific supply-chain requirement focused on OS vendor security engineering maturity, whereas Annex A 5.21 covers a wider set of supply chain risk processes and product/service types.
This control is broader than ISM-1786.
ISM-1786 requires an organisation to create and maintain an approved supplier list to control supplier engagement. ISO/IEC 27001:2022 Annex A 5.21 requires processes to manage ICT supply chain information security risks across products and services, including supplier selection, assurance, and ongoing risk treatment. ISM-1786 is one specific supply chain control that contributes to Annex A 5.21, but does not cover the full set of ICT supply chain risk activities.
This control is broader than ISM-1787.
ISM-1787 mandates organisations to only source IT/OT products and services from approved suppliers, reducing exposure to untrusted or high-risk vendors. This control contributes to Annex A 5.21 by reducing upfront supply chain risk. Annex A 5.21 is broader as it encompasses risk management across the ICT supply chain, including upstream components and end-to-end governance.
This control is broader than ISM-1788.
Annex A 5.21 requires organisations to define and implement processes to manage information security risks across the ICT products and services supply chain. ISM-1788 contributes to that objective by requiring organisations to identify multiple potential suppliers for critical ICT sourcing, which reduces concentration and continuity risks within the supply chain. Annex A 5.21 is broader because it covers governance, risk assessment, assurance and ongoing management across the full supplier lifecycle, not just supplier diversification.
This control is broader than ISM-1789.
ISM-1789 requires organisations to verify the authenticity of software, hardware, and services before their acceptance. ISO/IEC 27001:2022 Annex A 5.21 mandates the definition and implementation of processes to manage information security risks within the ICT supply chain, which includes authenticity and anti-counterfeit checks. However, Annex A 5.21 is broader as it encompasses end-to-end supply chain risk management, whereas ISM-1789 zeroes in on acceptance gate controls.
This control is broader than ISM-1790.
Annex A 5.21 requires organisations to define and implement procedures to manage ICT supply chain information security risks. ISM-1790 directly supports that by requiring deliveries of ICT and OT products/services to maintain integrity, mitigating in-transit tampering and compromise. Annex A 5.21 is broader because it encompasses governance and supplier management across the entire supply chain, while ISM-1790 is focused on the delivery/transport integrity aspect.
This control is broader than ISM-1791.
ISM-1791 requires integrity assessment of delivered IT/OT products and services before acceptance. Annex A 5.21 addresses managing information security risks across the ICT supply chain, which commonly includes controls for product authenticity, tamper detection, and acceptance verification. Annex A 5.21 has wider scope across sourcing, logistics and upstream suppliers, while ISM-1791 is the acceptance-stage integrity check within that broader supply chain management.
This control is broader than ISM-1792.
Annex A 5.21 requires processes and procedures to manage information security risks associated with ICT supply chain products and services. ISM-1792 is a specific control within that: assessing authenticity of delivered operating systems, applications, equipment and services as part of acceptance, addressing counterfeit/tampering risk. Annex A 5.21 is broader because it covers end-to-end supplier risk management (selection, contracting, monitoring and response), not only acceptance authenticity checks.
This control is broader than ISM-1800.
ISM-1800 requires flashing network devices with trusted firmware before first use to reduce the likelihood of supply chain or pre-compromise in device code. Annex A 5.21 requires managing information security risks associated with the ICT supply chain, including integrity and authenticity of ICT products and components obtained from suppliers. ISM-1800 is a specific supply-chain risk mitigation focused on firmware integrity at deployment, whereas Annex A 5.21 covers broader supplier, product, and service risks across the lifecycle.
This control is broader than ISM-1826.
Annex A 5.21 requires organisations to implement processes to manage information security risks across the ICT supply chain for products and services. ISM-1826 maps to that requirement by mandating vendor selection criteria for server applications based on Secure by Design/Secure by Default practices, directly addressing supplier-originated software security risk. Annex A 5.21 is broader because it applies across all ICT supply chain categories and lifecycle activities, not only secure development expectations for server application vendors.
This control is broader than ISM-1882.
ISM-1882 requires procurement from suppliers that demonstrate transparency for the products and services being acquired. Annex A 5.21 addresses managing information security risks across the ICT supply chain, where supplier transparency (e.g., visibility of components, vulnerabilities, development practices) is one mechanism to reduce supply chain risk. Annex A 5.21 is broader because it covers multi-tier supply chain governance and ongoing controls, not just the procurement decision emphasised by ISM-1882.
This control is broader than ISM-2023.
Annex A 5.21 requires organisations to implement processes to manage ICT supply chain security risks for products and services. ISM-2023 is a specific measure within that broader process: maintaining an authoritative software source to reduce the risk of untrusted or tampered software entering the environment via the supply chain. Annex A 5.21 is broader because it addresses supplier governance and risk management across multiple supplier types and lifecycle stages, beyond software provenance controls.
This control is broader than ISM-2026.
ISM-2026 requires scanning software artefacts for malicious content before placing them into the authoritative software repository. This supports ISO/IEC 27001:2022 Annex A 5.21 by providing a concrete control to reduce ICT supply chain risk from compromised or trojanised software components received from suppliers or third parties. Annex A 5.21 covers broader supply chain governance and procedures, whereas ISM-2026 is an operational technical check at the point of import.
This control is broader than ISM-2027.
ISM-2027 requires verification of software artefacts using digital signatures or secure hashes before they enter the organisation's authoritative software source. This supports Annex A 5.21 by acting as a supply-chain risk control that reduces the likelihood of tampered or counterfeit ICT products/software being introduced. Annex A 5.21 is broader and includes contractual, assurance, and ongoing supplier risk management activities beyond artefact verification.
This control is broader than ISM-2029.
ISM-2029 requires the authoritative source for software to restrict the use and import of third-party libraries and software components to trustworthy sources. Third-party components are part of the ICT supply chain, so this directly implements supply chain risk management for software as required by Annex A 5.21. Annex A 5.21 covers risks across all ICT products and services, whereas ISM-2029 addresses only the provenance of software components.
This control is broader than ISM-2082.
ISM-2082 requires developers to use a CBOM for imported third-party software components to confirm those components support standardised ASD‑Approved Cryptographic Algorithms. ISO/IEC 27001:2022 Annex A 5.21 addresses managing information security risks across the ICT supply chain for products and services, which includes evaluating security properties of third-party components. ISM-2082 is a specific technique within supply-chain assurance focused on cryptographic implementations, whereas Annex A 5.21 is broader across many supply-chain risk types and assurance activities.
This control is broader than ISM-2086.
Annex A 5.21 requires organisations to manage information security risks associated with ICT products and services throughout the supply chain. ISM-2086 fits within that by requiring verification of the source and integrity of AI models, structures and weights, addressing provenance and tampering risks from external model suppliers. Annex A 5.21 is broader because it applies across all ICT supply chain components and services, while ISM-2086 is focused on the AI artefact supply chain specifically.
This control is broader than ISM-2154.
ISM-2154 requires organisations to control ICT supply chain inputs at the code level by pinning third-party dependencies to approved versions in source code. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, which includes third-party software components, update channels and supplier assurance. ISM-2154 is a specific technical/procedural mechanism that implements part of Annex A 5.21, while Annex A 5.21 covers a wider range of supply chain risks and governance activities.
This control partially meets ISM-0072.
Annex A 5.21 requires processes and procedures to manage information security risks arising from ICT suppliers and service dependencies. ISM-0072 relates by mandating that confidentiality, integrity and availability requirements are documented in service provider contracts and reviewed regularly. Contractual security requirements are an important mechanism under Annex A 5.21, but the ISO control also covers broader supply chain activities such as supplier evaluation, assurance, and ongoing risk monitoring.
This control partially meets ISM-1804.
Annex A 5.21 addresses end-to-end management of ICT supply chain security risks via defined processes and procedures. ISM-1804 aligns by requiring break clauses in cloud service contracts tied to failure to meet security requirements, strengthening supplier accountability and exit options. This is a specific contractual safeguard within the wider supplier governance and risk management expectations of Annex A 5.21.
This control partially overlaps ISM-0039.
ISM-0039 requires a maintained cyber security strategy that drives how the organisation manages cyber risks to its information and services. Annex A 5.21 overlaps by requiring defined processes to manage ICT supply chain security risks, which is a common strategic risk theme and should be covered within the cyber strategy. ISM-0039 is broader and not limited to supply chain risk, while Annex A 5.21 is deeper and more specific to supplier/product/service lifecycle controls.
This control partially overlaps ISM-0286.
Annex A 5.21 requires organisations to establish processes and procedures to manage information security risks in the ICT supply chain. ISM-0286 overlaps by prescribing a specific procurement assurance action for high assurance IT equipment-contacting ASD for equipment-specific delivery procedures-supporting secure supply and delivery assurance. ISM-0286 is narrower and context-specific (high assurance procurement and delivery handling), while Annex A 5.21 is a general organisational control covering the full set of supply chain risk management processes.
This control partially overlaps ISM-0305.
ISM-0305 requires organisations to ensure maintenance and repairs occur on-site and are performed by appropriately cleared technicians, reducing supply chain and insider risks during servicing. Annex A 5.21 addresses managing information security risks associated with the ICT supply chain, including third-party service providers involved in support and maintenance. They overlap where maintenance is outsourced or vendor-supported, but Annex A 5.21 is broader across the full supply chain lifecycle, while ISM-0305 mandates a specific control for how maintenance is executed.
This control partially overlaps ISM-1073.
ISM-1073 requires contracts for system access by service providers. ISO/IEC 27001:2022 Annex A 5.21 involves mitigating ICT supply chain risks, including setting access requirements via contracts. Overlap exists but Annex A 5.21 addresses broader supply chain concerns.
This control partially overlaps ISM-1570.
ISM-1570 requires regular independent IRAP assessment of cloud service providers against the ISM, ensuring an objective security evaluation at least every 24 months. Annex A 5.21 requires processes to manage information security risks across the ICT supply chain, including suppliers and service providers that underpin service delivery. IRAP assessments can be used as supply-chain assurance evidence, but Annex A 5.21 is broader than cloud and includes upstream/downstream ICT components, while ISM-1570 is narrowly focused on cloud services and IRAP frequency.
This control partially overlaps ISM-1738.
ISM-1738 requires regular, ongoing verification of service providers against contractual security requirements. ISO/IEC 27001:2022 Annex A 5.21 covers managing information security risks in the ICT supply chain, including supplier assurance and monitoring. Although Annex A 5.21 has a wider scope across supply chain risks, it relates to ISM-1738's focus on provider verification.
- ISM-1972ASD security control assessment of TOP SECRET cloud services every 24 monthsPartially overlaps
This control partially overlaps ISM-1972.
Annex A 5.21 requires organisations to implement processes and procedures to manage ICT supply chain information security risks. ISM-1972 overlaps by imposing a recurring, ASD-assessor-led security assessment requirement for TOP SECRET cloud service providers and services, which is a strong assurance mechanism for a specific outsourced supply chain scenario. ISM-1972 is much more prescriptive and scope-limited (TOP SECRET cloud and ASD assessment cadence), while Annex A 5.21 is broader and generally applicable across all ICT supply chains and classification contexts.
This control partially overlaps ISM-2087.
ISM-2087 requires the organisation to verify the source and integrity of training data used for AI models to prevent data poisoning. Annex A 5.21 addresses managing information security risks in the ICT supply chain, which overlaps where training data is sourced from third parties, data brokers, SaaS platforms, or outsourced data engineering pipelines. Annex A 5.21 is broader, covering suppliers/products/services generally, while ISM-2087 is narrower and more specific to provenance and integrity validation of AI training datasets.
This control supports ISM-1631.
ISM-1631 requires organisations to identify all suppliers associated with systems (e.g. OS, applications, IT/OT equipment and services) so they can be managed as part of the cyber supply chain. ISO/IEC 27001:2022 Annex A 5.21 requires defined processes to manage ICT supply chain information security risks, which practically depends on having an accurate supplier inventory. While ISM-1631 focuses on supplier identification, Annex A 5.21 extends further into risk management processes across the supply chain.
This control depends on ISM-1195.
ISM-1195 requires organisations to enforce mobile device policy using an MDM solution that has passed a Common Criteria evaluation against the MDM Protection Profile. Annex A 5.21 addresses ICT supply chain security risk management for products and services, which includes assurance activities when procuring and operating security tooling like MDM. The controls align where Common Criteria evaluation is used as supply-chain assurance evidence, but Annex A 5.21 extends to the full supply chain lifecycle and multiple suppliers, not just MDM capability.
This control depends on ISM-1638.
ISM-1638 requires visibility of outsourced cloud services via a register that records the provider, contract arrangements, data classification/sensitivity, and responsible contacts for each service. This supports ISO/IEC 27001:2022 Annex A 5.21 by enabling an organisation to identify and track which ICT supply chain services (cloud) are in use and who owns the relationship, which is necessary to manage and treat supply chain security risks. Annex A 5.21 is broader because it requires defined processes/procedures for managing supply chain risk, beyond maintaining the service register.
This control depends on ISM-1736.
ISM-1736 requires organisations to maintain and regularly verify a register of managed services. This supports ISO/IEC 27001:2022 Annex A 5.21 because effective ICT supply chain risk management depends on knowing which external products and services are being used and who provides them. Annex A 5.21 extends beyond listing services into defining and operating risk management processes across the supply chain, whereas ISM-1736 is about establishing and validating the underlying service inventory.
This control depends on ISM-1797.
ISM-1797 requires software updates to be digitally signed or provided with cryptographic checksums to reduce the risk of tampering and counterfeit updates. ISO/IEC 27001:2022 Annex A 5.21 addresses ICT supply chain security risk management, where verifying update authenticity via signing/checksums is a concrete control to mitigate supplier and distribution-channel compromise. Annex A 5.21 is broader and includes contractual, assurance and monitoring activities that go beyond update integrity verification.
This control depends on ISM-2083.
ISM-2083 requires software producers to provide a CBOM to software users to increase transparency of cryptographic components. Annex A 5.21 requires processes to manage ICT supply chain information security risks, and a CBOM supports this by improving visibility into third-party cryptographic dependencies and enabling risk assessment of algorithms and libraries. Annex A 5.21 is about supply chain risk management generally, while ISM-2083 is a specific requirement for cryptographic component disclosure.
This control depends on ISM-2124.
ISM-2124 requires that service provider access is tightly controlled through explicitly approved remote management tools, source addresses and time windows. Annex A 5.21 supports this by requiring defined processes to manage ICT supply chain information security risks, which commonly includes constraining and governing third-party remote administration channels. ISM-2124 is a specific technical/operational control for remote access, while Annex A 5.21 is broader supply-chain risk management across products and services.
This control depends on ISM-2125.
ISM-2125 requires the organisation to independently log and analyse service provider access in a tamper-resistant manner to identify unauthorised activity. Annex A 5.21 requires processes and procedures to manage information security risks in the ICT supply chain. ISM-2125 supports Annex A 5.21 by providing an operational control that reduces and detects supplier-borne risk (especially privileged/remote access risk), but Annex A 5.21 is broader and includes many other supply chain risk treatments beyond logging and monitoring.
This control depends on ISM-2155.
ISM-2155 requires reproducible builds so that released binaries can be independently verified against the stated source code, reducing the risk of build-time tampering. Annex A 5.21 focuses on managing ICT supply chain security risks across products and services, and ISM-2155 supports this by providing a strong integrity assurance mechanism for supplier-delivered software and internally built components used in the supply chain. Annex A 5.21 is broader governance over suppliers and components, while ISM-2155 is a technical assurance practice focused on build provenance.
ASD Essentials for enterprise IT: 4 mappings
This control is broader than IT.GOV-11.1.
IT.GOV-11.1 requires suppliers of software, hardware and services to be selected and engaged on the basis of a cyber supply chain risk assessment proportionate to the risk they introduce, with assurance evidence retained to support the decision. This is a specific implementation of ISO/IEC 27001 Annex A 5.21, which requires processes and procedures to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 spans the whole supply chain risk process, while IT.GOV-11.1 focuses on the risk-based selection and engagement decision.
This control is broader than IT.GOV-11.2.
IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when that assurance lapses or the supplier's risk changes. This is a specific component of ISO/IEC 27001 Annex A 5.21, which requires processes and procedures to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 covers the broader supply chain risk process, whereas IT.GOV-11.2 focuses on continuing supplier assurance and response.
- IT.PRO-16.1Verify integrity, authenticity and provenance of software, components and updates before useBroader than
This control is broader than IT.PRO-16.1.
IT.PRO-16.1 requires the integrity and authenticity of software, components and updates to be assessed before use, with provenance verified where suitable supplier evidence is available. This is a specific safeguard within the processes ISO/IEC 27001 Annex A 5.21 requires to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 covers the broader supply chain risk process, while IT.PRO-16.1 targets software integrity and provenance.
- IT.PRO-16.2Monitor vendor advisories and threat intelligence to act on supply chain exposureBroader than
This control is broader than IT.PRO-16.2.
IT.PRO-16.2 requires vendor advisories and threat intelligence to be used to maintain awareness of supplier, product and component exposure to compromise, and to act within timeframes proportionate to the risk. This is a specific monitoring and response activity within the processes ISO/IEC 27001 Annex A 5.21 requires to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 covers the full supply chain risk process, while IT.PRO-16.2 concentrates on tracking and responding to compromise.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.