ISO 27001 Annex A 5.22 Monitoring and managing supplier services
What it says
The organization shall regularly monitor, review, evaluate and manage change in supplier information security practices and service delivery.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep track of and adapt to changes in how suppliers handle security and service delivery.
Think of this as keeping a close eye on the services your suppliers provide to ensure they are following the security and service rules you both agreed on. If this isn't done, a supplier might change something important, like their security settings, without your knowledge. This could leave the door open for data breaches or service disruptions, which could hurt your business or reputation.
Free. Save your status, tasks and notes.
Why it matters
Without monitoring supplier services, unnoticed security changes can lead to data breaches, loss of trust and financial impacts.
How to implement
The procurement manager should include clear security terms in contracts with suppliers.
Ensure these terms outline security expectations, how often service reviews will occur, and what happens if standards are not met. This aligns with ISO 27002:2022 guidance and helps ensure suppliers meet agreed security practices.
An IT manager should regularly monitor supplier performance against contracted security measures.
This can be achieved by setting up routine checks and evaluations of supplier systems and processes, verifying they meet requirements laid out in agreements.
The compliance officer should organise audits of suppliers' operations.
Use external audits when necessary, and complement with internal review of suppliers' compliance with security practices. Follow the CPS 234 and reference ISO 27002:2022 to ensure comprehensive evaluations.
The supplier relationship manager should schedule regular meetings with suppliers to discuss and review service reports and incident responses.
This promotes open dialogue about any issues and ensures all parties are aligned on security needs.
IT staff should track any technological changes or upgrades by the supplier that could affect security or service delivery.
Update security checks to include these changes and ensure continuity of services as per agreement.
Keep it running
Regularly review supplier security reports; trigger deeper evaluations on changes, incidents, or contract renewals to ensure compliance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request service level agreements and any security addendums with suppliers.
Look at
Check if these documents clearly outline security expectations and vendor responsibilities.
Good evidence
Agreements reference specific security practices and contain provisions for monitoring and audits.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of service reviews or performance assessments conducted on suppliers.
Look at
Ensure reviews occur regularly and detail compliance with agreed terms.
Good evidence
Documentation shows routine monitoring and matches contracted frequency.
- Check 3 of 5What an auditor asks for
Ask for
Request logs of meetings and communications with suppliers discussing service changes and security incidents.
Look at
Check meeting frequency and content for meaningful engagement on issues.
Good evidence
Meetings and follow-up actions are documented, showing proactive management.
- Check 4 of 5What an auditor asks for
Ask for
Ask for audit reports or certificates obtained from or about the suppliers.
Look at
Verify reports address critical security areas relevant to your agreements.
Good evidence
Reports indicate thorough audits have been conducted with satisfactory compliance results.
- Check 5 of 5What an auditor asks for
Ask for
Require documentation of supplier changes affecting information systems.
Look at
Review how changes are logged and communicated to your organisation.
Good evidence
Change logs detail what was updated and when your organisation was informed.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.GOV-11.2, Maintain current supplier assurance and act on lapses or risk changes, which asks for the same thing.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires ongoing assurance that supplier-provided AI dependencies continue to align with responsible AI development and use. ISO/IEC 27001:2022 Annex A 5.22 supports this by requiring monitoring, review, evaluation and change management of supplier security practices and service delivery, which helps detect supplier changes that could affect AI integrity or compliance (e.g., model version changes, hosting configuration changes). Annex A 5.22 is centred on supplier information security performance, while Annex A 10.3 requires a broader responsible-AI monitoring lens (e.g., output safety and transparency commitments).
ASD Information Security Manual: 23 mappings
This control is broader than ISM-1793.
ISM-1793 mandates periodic (24‑monthly) IRAP assessments of managed service providers against the ISM to provide assurance of their security posture. Annex A 5.22 requires organisations to regularly monitor, review, and evaluate supplier security practices and service delivery, and IRAP assessment results are a concrete mechanism to evidence and inform that ongoing monitoring and review. Annex A 5.22 can be more frequent and operational in nature (service performance/security practice changes), whereas ISM-1793 is a formal independent assessment requirement on a defined cycle.
This control is broader than ISM-1794.
ISM-1794 requires suppliers to provide at least one month's notice of significant changes to their own downstream service provider arrangements, as documented in the contract. ISO/IEC 27001:2022 Annex A 5.22 relates by requiring organisations to monitor, review, evaluate and manage change in supplier information security practices and service delivery, which depends on timely awareness of supplier changes. ISM-1794 focuses specifically on advance notification via contractual commitment, while Annex A 5.22 is broader and includes ongoing performance/security monitoring and change management activities.
This control is broader than ISM-1826.
ISM-1826 requires selecting vendors whose server applications are engineered with Secure by Design/Secure by Default and strong secure programming practices. Annex A 5.22 requires the organisation to monitor, review, evaluate and manage changes in supplier security practices and service delivery over time. ISM-1826 addresses the upfront selection decision, while Annex A 5.22 extends into ongoing supplier governance after selection.
This control is broader than ISM-2125.
ISM-2125 requires the organisation to maintain independent, tamper-proof logs of service provider access and to analyse them promptly to detect unauthorised activity. Annex A 5.22 focuses on monitoring, reviewing and managing supplier service delivery and changes in supplier security practices. ISM-2125 supports Annex A 5.22 by providing concrete, auditable telemetry and detection evidence to monitor supplier behaviour in operational environments, but Annex A 5.22 also covers broader supplier governance beyond access logging.
This control partially meets ISM-0731.
ISM-0731 requires CISO oversight of cyber supply chain risk management activities. Annex A 5.22 requires ongoing monitoring, review, evaluation, and change management of supplier security practices and service delivery, which is an operational control activity the CISO should ensure is performed under ISM-0731. Annex A 5.22 is procedural and continuous assurance-focused, while ISM-0731 is a governance role requirement.
This control partially meets ISM-1786.
ISM-1786 requires an organisation to implement and maintain an approved supplier list. ISO/IEC 27001:2022 Annex A 5.22 requires ongoing monitoring, review, evaluation and management of change in supplier security practices and service delivery, which generally assumes the organisation has identified which suppliers are in scope. ISM-1786 provides the baseline governance (who is approved), while Annex A 5.22 is broader and focuses on continual oversight of those suppliers' performance and security posture.
This control partially overlaps ISM-1073.
ISM-1073 emphasises contracts before a service provider can access organisational systems, aligning partially with ISO/IEC 27001:2022 Annex A 5.22, which involves managing supplier service delivery. The overlap occurs where contracts define access terms vital to service management.
This control partially overlaps ISM-1395.
Annex A 5.22 requires monitoring and review of supplier security practices and service delivery, and managing changes affecting security. ISM-1395 overlaps by mandating that service providers protect data, which is a key aspect of monitoring and evaluation. ISM-1395 focuses on protection obligations, while Annex A 5.22 involves ongoing assurance and change management.
This control partially overlaps ISM-1452.
Annex A 5.22 requires the organisation to regularly monitor, review and evaluate supplier information security practices and service delivery, and to manage changes in those supplier services. ISM-1452 involves supply chain risk assessments for IT/OT suppliers to understand how supplier choices and changes affect the system's security risk profile. The overlap lies in ongoing supplier risk evaluation, with ISM-1452 focusing on risk assessment during selection/procurement and significant changes.
This control partially overlaps ISM-1570.
ISM-1570 requires outsourced cloud service providers and their relevant cloud services to undergo an IRAP assessment at least every 24 months against the latest ISM release. Annex A 5.22 requires an organisation to regularly monitor, review and evaluate supplier security practices and service delivery, which can be evidenced and strengthened through recurring independent assessments such as IRAP. However, Annex A 5.22 is broader across all suppliers and ongoing performance management, while ISM-1570 is a specific, time-bound assurance requirement for cloud providers via IRAP.
This control partially overlaps ISM-1738.
Annex A 5.22 requires organisations to monitor and evaluate supplier practices and service delivery, including managing change. ISM-1738 relates by requiring the organisation to verify service provider compliance with documented security requirements. ISM-1738 focuses on compliance verification, while Annex A 5.22 is broader, covering service delivery performance and change management.
This control partially overlaps ISM-1882.
ISM-1882 requires procurement from suppliers that demonstrate transparency for their products and services. Annex A 5.22 requires ongoing monitoring, review, and management of supplier information security practices and service delivery, which can include verifying that suppliers continue to be transparent (e.g., timely disclosure of vulnerabilities and changes). They overlap on the expectation of supplier behaviour around transparency, but Annex A 5.22 is focused on post-procurement governance while ISM-1882 is primarily a procurement gate.
- ISM-1972ASD security control assessment of TOP SECRET cloud services every 24 monthsPartially overlaps
This control partially overlaps ISM-1972.
ISM-1972 requires a recurring (at least 24-monthly) security control assessment of outsourced TOP SECRET cloud services performed by ASD assessors (or delegates) against the ISM baseline. ISO/IEC 27001:2022 Annex A 5.22 requires organisations to regularly monitor, review and evaluate supplier security practices and service delivery, which overlaps with the intent to periodically evaluate an outsourced cloud provider's security controls. The difference is that Annex A 5.22 is an organisation-managed supplier assurance process across suppliers generally, whereas ISM-1972 is a mandated, ASD-led assessment regime limited to TOP SECRET/SCI cloud services with a defined cadence and assessment authority.
This control supports ISM-1567.
ISM-1567 requires that suppliers deemed high risk by a cyber supply chain risk assessment are not used. ISO/IEC 27001:2022 Annex A 5.22 focuses on regularly monitoring, reviewing, and managing changes in supplier security practices and service delivery, which helps identify when a supplier becomes high risk. Annex A 5.22 supports ISM-1567 by providing the ongoing assurance and change-detection needed to trigger re-assessment and potential supplier avoidance, but it does not itself mandate excluding high-risk suppliers.
This control supports ISM-1637.
Annex A 5.22 requires monitoring and review of supplier services and security practices, including managing changes. ISM-1637 supports this by maintaining and verifying an outsourced cloud service register, improving visibility of suppliers and services monitored under Annex A 5.22.
This control supports ISM-1737.
ISM-1737 requires a managed service register that includes, for each service, the due date for the next security assessment and 24/7 provider contact details. Annex A 5.22 focuses on ongoing monitoring, review and change management of supplier security practices and service delivery, which is enabled by having a register that schedules assessments and identifies who to contact for reviews and escalation. Annex A 5.22 goes beyond the register by requiring evaluation of performance and changes, not just maintaining service records.
This control supports ISM-1787.
ISM-1787 ensures IT/OT products and services are sourced from approved suppliers, establishing a controlled set of vendors. This supports Annex A 5.22, which focuses on ongoing oversight of supplier service delivery. The pre-approval of suppliers aids in monitoring supplier security practices.
This control supports ISM-1790.
ISM-1790 requires that delivered IT/OT systems and services maintain integrity, implying controls such as tamper-evident delivery, verified provenance and secure handover. Annex A 5.22 strengthens this by requiring the organisation to monitor and review supplier service delivery and security practices, increasing the likelihood that delivery-integrity requirements are consistently met. Annex A 5.22 is ongoing supplier assurance, while ISM-1790 is the specific integrity requirement at the point of delivery and acceptance.
This control depends on ISM-0072.
Annex A 5.22 requires monitoring, review and evaluation of supplier practices against expectations, and to manage changes. ISM-0072 is a prerequisite by requiring documentation of security requirements in contracts and regular reviews, providing the baseline criteria for Annex A 5.22's activities.
This control depends on ISM-1571.
ISM-1571 requires service provider contracts include a documented right for the organisation to verify compliance with security requirements. Annex A 5.22 requires the organisation to monitor, review and evaluate supplier information security practices and service delivery, and exercising that monitoring often depends on having contractual audit/assessment rights. Annex A 5.22 is focused on ongoing supplier oversight, while ISM-1571 is focused on ensuring the contractual permission exists to perform that oversight.
This control depends on ISM-1631.
ISM-1631 requires organisations to identify all relevant suppliers in the cyber supply chain for systems and services. ISO/IEC 27001:2022 Annex A 5.22 requires organisations to monitor, review and manage changes in supplier security practices and service delivery, which depends on having a defined set of suppliers to monitor. ISM-1631 is limited to identification, while Annex A 5.22 focuses on ongoing assurance and change oversight.
This control depends on ISM-1638.
ISM-1638 requires an outsourced cloud service register with security assessment due dates and contractual and contact details for each cloud service. Annex A 5.22 requires regularly monitoring, reviewing, evaluating, and managing changes in supplier security practices and service delivery, which is enabled by having an authoritative list of cloud suppliers/services and review cadence captured in the register. Annex A 5.22 goes further into ongoing performance/security management, whereas ISM-1638 focuses on maintaining the underlying inventory and key governance metadata.
This control depends on ISM-1736.
Annex A 5.22 requires regular monitoring, review and evaluation of supplier services and the management of changes in supplier delivery and security practices. ISM-1736 supports this by establishing and regularly verifying a managed service register, providing an authoritative inventory of supplier-provided services for the organisation to monitor and review. ISM-1736 is a governance mechanism enabling visibility and completeness.
ASD Essentials for enterprise IT: 1 mapping
This control is equivalent to IT.GOV-11.2.
IT.GOV-11.2 requires the organisation to maintain current assurance that suppliers continue to meet their cyber security commitments, and to act when that assurance lapses or a supplier's risk changes. ISO/IEC 27001 Annex A 5.22 requires the same ongoing monitoring, review and evaluation of supplier information security practices, together with management of changes in them. The two are substantially equivalent, although Annex A 5.22 also refers explicitly to monitoring supplier service delivery.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.