Key takeaways
- Put the necessary security requirements into supplier contracts.
- Contracts are how you make suppliers commit to security.
- Start here: define standard security clauses: confidentiality, breach notification, audit rights, data return.
Purpose
Put the necessary security requirements into supplier contracts.
Requirement
Requirement summaryRelevant information security requirements shall be established and agreed with each supplier based on the type of supplier relationship.
Why it matters
Contracts are how you make suppliers commit to security. If it is not in the agreement, it is hard to enforce.
How to implement
- Define standard security clauses: confidentiality, breach notification, audit rights, data return.
- Include them in contracts or data processing agreements based on supplier risk.
- Track which suppliers have signed which terms.
- Revisit clauses when contracts renew.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.20. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your standard contract wording for supplier security.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.20 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Signed contracts with key suppliers that include security, confidentiality, breach notification and right-to-audit terms.
- Data processing agreements where suppliers handle personal data.
Things you should be able to show or explain
- Be able to explain how security terms are agreed with suppliers.
How much to show: Three to five key supplier contracts.
Common mistakes
- Contracts with no breach notification terms.
- Old contracts never updated.
- Relying on the supplier's standard terms without review.
- No breach notification timeframe.
- Tip: Keep a standard security schedule to attach to contracts.
Policies & documents to have
- Third-Party Management Policy
FAQ
Is A.5.20 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.20?
Be ready to explain how the control works in your organisation and to provide things like: Your standard contract wording for supplier security…