ISO & compliance · Guide

ISO 27001 supplier security: what auditors expect

ISO 27001 expects you to know which suppliers can affect your information security, to agree security terms with them, and to keep checking. Auditors look for evidence that this happens, not just a policy that says it should.

Updated 26 October 2026 · Nexus Digital Ireland

Why suppliers matter in ISO 27001

Most small businesses hold their information with other companies: email and file storage in the cloud, an accounting system, an IT provider with remote access, a payroll bureau. A weakness at any of them can become your incident. ISO 27001 therefore treats supplier relationships as part of your information security, not something outside it.

The supplier controls in ISO 27001:2022

The 2022 version of the standard groups supplier security into five controls in Annex A:

5.19 Supplier relationships: Decide how you manage the security risks of using suppliers' products and services.
5.20 Security in supplier agreements: Agree the relevant security requirements with each supplier, in writing.
5.21 The ICT supply chain: Manage the risks that come from your IT suppliers' own suppliers and products.
5.22 Monitoring and change: Monitor, review and evaluate supplier security, and manage changes to the services they provide.
5.23 Cloud services: Set out how you acquire, use, manage and exit cloud services securely.

This is a plain-English summary for orientation, not the text of the standard. Your certification body and the standard itself are the reference for what your organisation must do.

The evidence auditors usually ask to see

A supplier inventory: who your suppliers are, what they do for you and what information or systems they can reach.
A risk rating for each supplier, so the ones handling sensitive data or with system access get more attention.
Records of the checks you made before using an important supplier, such as a security questionnaire, their certifications or a data processing agreement.
Contracts or terms that cover security, confidentiality, incident notification and what happens to your data at the end.
Periodic reviews of key suppliers, with the date, the outcome and any actions.
Records of changes, incidents or exits involving suppliers, and what you did about them.

A simple supplier security process for a small business

List your suppliersStart with everyone you pay, then mark which ones hold your data or can access your systems.
Rate the riskHigh for suppliers with personal data, customer data or admin access; lower for the rest.
Check before you rely on themFor higher-risk suppliers, record what you checked: certifications, a questionnaire, their data processing terms.
Agree the termsMake sure the contract or terms cover confidentiality, security, breach notification and data return or deletion.
Review on a scheduleReview high-risk suppliers at least yearly, and when something changes, and record the outcome.
Exit cleanlyWhen a supplier leaves, remove its access and confirm what happened to your data.

Proportion matters. A ten-person business is not expected to audit its stationery supplier, but it is expected to know how its email provider and IT support company protect its information.

Common gaps found at audit

A supplier policy exists, but there is no list showing which suppliers it applies to.
Reviews were done once, at certification, and never repeated.
Evidence sits in old email threads and cannot be found when the auditor asks.
Cloud services were signed up to by individual staff and never assessed.
Former suppliers still have accounts or access.

How the Operations Register supports ISO 27001 supplier controls

The Nexus Business Operations Register keeps the supplier inventory, reviews, approvals and evidence that ISO 27001 supplier controls expect, as part of everyday purchasing. Nexus does not award certification.

One supplier register with category, owner, status, contacts and linked evidence.
Supplier reviews with a decision, a reviewer and the date, and separation of duties where it is required.
Uploaded evidence is security-checked and kept with the supplier it belongs to.
An audit trail of who approved what and when, ready for an audit or a customer's security questionnaire.

Supplier due diligence Audit trail ISO and QHSE governance

Questions

Which ISO 27001 controls cover suppliers?

In ISO 27001:2022, Annex A controls 5.19 to 5.23 cover supplier relationships, security in supplier agreements, the ICT supply chain, monitoring and change of supplier services, and the use of cloud services.

Do I have to assess every supplier?

No. The effort should match the risk. Suppliers that hold your data or can access your systems need assessment and review; low-risk suppliers usually only need to be on your list.

How often should suppliers be reviewed?

The standard leaves the frequency to you, based on risk. Many small organisations review high-risk suppliers at least once a year and whenever the service or the supplier changes.

Is a supplier's own ISO 27001 certificate enough?

It is good evidence, but check that the certificate is current, from an accredited certification body, and covers the service you actually use.

Related guides

ISO audit evidence checklist for supplier management

Most audit stress comes from evidence that exists somewhere but cannot be found quickly. This checklist lists the supplier evidence auditors commonly ask for, so you can keep it ready as you work.

Read the guide →

Does my small business need ISO certification?

Most small businesses do not need ISO certification until a customer, tender or regulator asks for it. When they do, the work is easier if the evidence is already being kept as part of everyday work.