verifiedISO/IEC 27001:2022
ISO 27001 Annex A 5.21Managing Information Security in the ICT Supply Chain
Official control statement
Processes and procedures shall be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.
verifiedISO/IEC 27001:2022Annex A 5.21
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure ICT supply chain security by managing risks with processes and procedures.
Organisational controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about making sure the technology products and services you get from your suppliers are secure. If someone in the chain is sloppy or lacks security, it could lead to problems like data breaches, service disruptions, or financial loss. Think of it like ensuring your house is built with quality materials - if one part is weak, the whole structure could be compromised.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Weak ICT supply chain security can lead to data breaches or disruptions as insecure supply chain links provide attackers a backdoor into your organisation.
settings
Operational notes
Regularly assess supplier security practices, contracts and access; track vendor vulnerabilities and updates to manage ICT supply chain risks.
02 - Implement
build
Implementation tips
- The procurement team should define clear security requirements when purchasing any ICT products or services. They should ensure suppliers know exactly what security measures need to be in place, such as data protection and system integrity, and include these details in contracts.
- An IT manager should ensure that all suppliers are required to apply the organisation's security practices throughout their own supply chains. This includes asking for a list of their critical components and verifying how they ensure these components are secure.
- The IT security officer should set up a process to regularly review and monitor suppliers' compliance with security requirements. This could involve routine checks like penetration tests or reviewing third-party security assessments.
- A project manager should be tasked with identifying all critical components of each ICT product or service. They should maintain an updated list and ensure any changes or updates from the supplier do not introduce risks.
- Executives should ensure there is a plan for what happens if a main supplier can no longer provide a product or service. This includes finding alternative suppliers and making sure knowledge and data can be transferred without issues.
03 - Audit
fact_check
Audit / evidence tips
- AskRequest the security requirements documentation provided to ICT suppliers.Look atCheck if the security requirements cover confidentiality, integrity, and availability of information.GoodDocuments are comprehensive and included in supplier contracts, ensuring clear expectations.
- AskObtain the list of suppliers with their compliance evidence for security practices.Look atVerify if the suppliers have third-party security attestations or certifications.GoodAll suppliers have up-to-date compliance certificates or equivalent security validations.
- AskReview the monitoring and validation reports for supplier compliance.Look atLook for records of regular checks, tests, or audits conducted on the supplier's products.GoodReports show regular and documented security checks with suppliers meeting all set requirements.
- AskRequest the list of critical components identified in ICT products or services.Look atCheck if there are documented details about each component's significance and security status.GoodThe list is comprehensive and updated regularly with all critical components adequately protected.
- AskExamine the supplier continuity and alternative plans.Look atVerify if there's a risk management plan outlining alternative suppliers and a transfer process.GoodPlans are detailed with clear procedures for transitioning to alternative suppliers without disruption.
04 - Mappings
link
Cross-framework mappings
How Annex A 5.21 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 10.3 | Annex A 10.3 requires a supplier process ensuring third-party inputs used for AI align with responsible AI development and use | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1452 | ISM-1452 requires a supply chain risk assessment for suppliers of operating systems, applications, IT/OT equipment and services to determ... | |
open_in_fullBroader than(28)expand_less | ||
| ISM-0280 | ISM-0280 requires organisations to prefer procuring products that have completed Protection Profile (PP)-based evaluations (including app... | |
| ISM-0285 | ISM-0285 requires evaluated products to be delivered in accordance with delivery procedures specified in evaluation documentation | |
| ISM-0731 | ISM-0731 requires the CISO to oversee cyber supply chain risk management activities for their organisation | |
| ISM-0840 | ISM-0840 requires that when an organisation outsources destruction of media holding non-accountable material, it uses a specifically cert... | |
| ISM-0938 | ISM-0938 focuses on choosing vendors for user applications who demonstrate Secure by Design/Secure by Default practices | |
| ISM-1395 | Annex A 5.21 requires defined processes to manage information security risks arising from ICT supply chain products and services | |
| ISM-1567 | Annex A 5.21 requires defined processes and procedures to manage information security risks arising from ICT supply chain products and se... | |
| ISM-1568 | ISM-1568 requires organisations to procure operating systems, applications, IT/OT equipment and services from suppliers that have demonst... | |
| ISM-1632 | ISM-1632 requires organisations to procure ICT/OT products and services from suppliers with a proven ability to maintain the security of ... | |
| ISM-1737 | Annex A 5.21 requires defined processes and procedures to manage information security risks associated with ICT supply chain products and... | |
| ISM-1743 | ISM-1743 requires organisations to choose operating system vendors that demonstrate Secure by Design/Secure by Default practices and pref... | |
| ISM-1786 | ISM-1786 requires an organisation to create and maintain an approved supplier list to control supplier engagement | |
| ISM-1787 | ISM-1787 mandates organisations to only source IT/OT products and services from approved suppliers, reducing exposure to untrusted or hig... | |
| ISM-1788 | Annex A 5.21 requires organisations to define and implement processes to manage information security risks across the ICT products and se... | |
| ISM-1789 | ISM-1789 requires organisations to verify the authenticity of software, hardware, and services before their acceptance | |
| ISM-1790 | Annex A 5.21 requires organisations to define and implement procedures to manage ICT supply chain information security risks | |
| ISM-1791 | ISM-1791 requires integrity assessment of delivered IT/OT products and services before acceptance | |
| ISM-1792 | Annex A 5.21 requires processes and procedures to manage information security risks associated with ICT supply chain products and services | |
| ISM-1800 | ISM-1800 requires flashing network devices with trusted firmware before first use to reduce the likelihood of supply chain or pre-comprom... | |
| ISM-1826 | Annex A 5.21 requires organisations to implement processes to manage information security risks across the ICT supply chain for products ... | |
| ISM-1882 | ISM-1882 requires procurement from suppliers that demonstrate transparency for the products and services being acquired | |
| ISM-2023 | Annex A 5.21 requires organisations to implement processes to manage ICT supply chain security risks for products and services | |
| ISM-2026 | ISM-2026 requires scanning software artefacts for malicious content before placing them into the authoritative software repository | |
| ISM-2027 | ISM-2027 requires verification of software artefacts using digital signatures or secure hashes before they enter the organisation's autho... | |
| ISM-2029 | ISM-2029 requires the authoritative source for software to restrict the use and import of third-party libraries and software components t... | |
| ISM-2082 | ISM-2082 requires developers to use a CBOM for imported third-party software components to confirm those components support standardised ... | |
| ISM-2086 | Annex A 5.21 requires organisations to manage information security risks associated with ICT products and services throughout the supply ... | |
| ISM-2154 | ISM-2154 requires organisations to control ICT supply chain inputs at the code level by pinning third-party dependencies to approved vers... | |
layersPartially meets(2)expand_less | ||
| ISM-0072 | Annex A 5.21 requires processes and procedures to manage information security risks arising from ICT suppliers and service dependencies | |
| ISM-1804 | Annex A 5.21 addresses end-to-end management of ICT supply chain security risks via defined processes and procedures | |
sync_altPartially overlaps(8)expand_less | ||
| ISM-0039 | ISM-0039 requires a maintained cyber security strategy that drives how the organisation manages cyber risks to its information and services | |
| ISM-0286 | Annex A 5.21 requires organisations to establish processes and procedures to manage information security risks in the ICT supply chain | |
| ISM-0305 | ISM-0305 requires organisations to ensure maintenance and repairs occur on-site and are performed by appropriately cleared technicians, r... | |
| ISM-1073 | ISM-1073 requires contracts for system access by service providers | |
| ISM-1570 | ISM-1570 requires regular independent IRAP assessment of cloud service providers against the ISM, ensuring an objective security evaluati... | |
| ISM-1738 | ISM-1738 requires regular, ongoing verification of service providers against contractual security requirements | |
| ISM-1972 | Annex A 5.21 requires organisations to implement processes and procedures to manage ICT supply chain information security risks | |
| ISM-2087 | ISM-2087 requires the organisation to verify the source and integrity of training data used for AI models to prevent data poisoning | |
handshakeSupports(1)expand_less | ||
| ISM-1631 | ISM-1631 requires organisations to identify all suppliers associated with systems (e.g | |
extensionDepends on(8)expand_less | ||
| ISM-1195 | ISM-1195 requires organisations to enforce mobile device policy using an MDM solution that has passed a Common Criteria evaluation agains... | |
| ISM-1638 | ISM-1638 requires visibility of outsourced cloud services via a register that records the provider, contract arrangements, data classific... | |
| ISM-1736 | ISM-1736 requires organisations to maintain and regularly verify a register of managed services | |
| ISM-1797 | ISM-1797 requires software updates to be digitally signed or provided with cryptographic checksums to reduce the risk of tampering and co... | |
| ISM-2083 | ISM-2083 requires software producers to provide a CBOM to software users to increase transparency of cryptographic components | |
| ISM-2124 | ISM-2124 requires that service provider access is tightly controlled through explicitly approved remote management tools, source addresse... | |
| ISM-2125 | ISM-2125 requires the organisation to independently log and analyse service provider access in a tamper-resistant manner to identify unau... | |
| ISM-2155 | ISM-2155 requires reproducible builds so that released binaries can be independently verified against the stated source code, reducing th... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
Annex A 5.18
Managing Access Rights to Information Assets
Annex A 5.19
Managing Information Security in Supplier Relationships
Annex A 5.20
Integrating security clauses in supplier agreements
Annex A 5.22
Monitoring and Managing Supplier Services
Annex A 5.23
Cloud Service Security Management
Annex A 5.24
Information security incident management planning and preparation
See all Organisational controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.