ISO/IEC 27001 is the certifiable standard for an information security management system (ISMS); Annex A is its appendix of candidate controls, and five of them - 5.19 through 5.23 - cover supplier relationships specifically. Annex A states what each control requires in a sentence or two; it does not explain how to implement it. ISO/IEC 27002:2022 adds implementation guidance for every control, and ISO/IEC 27036 - already covered on this site - goes deeper still: Part 3 (hardware, software, and services supply chain security) maps onto control 5.21, and Part 4 (security of cloud services) maps onto control 5.23. This page stays at the Annex A level: what the five controls actually say, what changed when they were renumbered in 2022, and - the part a TPRM program most needs - what a vendor's ISO 27001 certificate does and does not prove about its supplier program.
The five controls, then and now
ISO/IEC 27001:2022 reorganized Annex A from 114 controls in 14 clauses down to 93 controls in four themes (Organizational, People, Physical, Technological). The supplier controls sit in the Organizational theme, and four of the five are a straight renumbering of the 2013 edition's clause A.15; only one is genuinely new:
| 2022 control | What it requires | 2013 equivalent |
|---|---|---|
| 5.19 Information security in supplier relationships | The parent objective: define and implement processes to manage the information security risk that comes from using a supplier's products or services. | A.15.1.1 |
| 5.20 Information security in supplier agreements | Establish and agree relevant information security requirements with each supplier, based on the type of relationship and the data or access involved. | A.15.1.2 |
| 5.21 Managing information security in the ICT supply chain | Define and implement processes for the security risk specific to ICT products and services supply chains, including sub-tier suppliers. | A.15.1.3 |
| 5.22 Monitoring, review and change management of supplier services | Regularly monitor, review, and audit supplier service delivery, and manage the security implications of any change to it. | A.15.2.1 + A.15.2.2 (merged) |
| 5.23 Information security for use of cloud services | Define processes for acquiring, using, managing, and exiting cloud services in line with the organization's own security requirements. | none - new in 2022 |
5.23 is the only supplier control among the eleven new controls the 2022 revision introduced. That is worth pausing on: a 2013-certified ISMS could satisfy every supplier-relationship control it was audited against and still have no requirement at all covering how the organization vets, monitors, or exits a cloud provider - the fastest-growing category of supplier most programs actually have. The gap existed because 5.19-5.22's general supplier language was written for negotiated, bespoke contracts; a cloud provider's standard terms, shared-responsibility model, and ability to change its own subprocessors without individual notice needed a control of its own.
What "certified against Annex A" actually means
ISO 27001 certification is not a checklist audit against all 93 controls equally. Clause 6.1.3(d) of ISO/IEC 27001:2022 requires every certified organization to produce a Statement of Applicability (SoA) - a document naming which Annex A controls it has selected as applicable to its own risk assessment, which it has excluded, and why. The certification audit then tests whether the organization actually does what its own SoA says, not whether it satisfies some fixed external checklist. That distinction matters directly for TPRM: a certificate proves an accredited body confirmed the SoA's claims were implemented and operating, not that the SoA set a particularly high bar. An organization with essentially no third-party dependencies could reasonably exclude 5.19-5.23 with a documented justification and still hold a valid certificate; an organization that runs its entire product on outsourced infrastructure and vendor code cannot exclude them and expect that exclusion to survive audit. Reading the SoA - not just the certificate - is the only way to know which of the five controls a given vendor actually claims to operate.
The certificate itself carries one more check worth running: the edition it cites. The International Accreditation Forum's transition mandate (IAF MD 26) gave certified organizations a three-year window from the 2022 edition's publication to move from the 2013 to the 2022 control set, ending 31 October 2025. That date has passed. A vendor presenting a certificate that still cites ISO/IEC 27001:2013 today is not presenting a valid certificate at all - it should be flagged and followed up before it is accepted as evidence of anything.
What 5.20 expects inside the agreement itself
Annex A states 5.20's objective in one line; ISO/IEC 27002's guidance for the same control is where the specifics live, and they read like a checklist a legal team can actually use: a description of the information, product, or service being supplied and its classification; the applicable legal, regulatory, and contractual requirements, including data-protection obligations; the supplier's duty to protect information proportionate to its sensitivity; rules on acceptable use and, where relevant, a defined list of supplier personnel authorized to access specific information; incident management and notification requirements; screening requirements for supplier personnel with access to sensitive data; the right to audit the supplier's processes and controls; a process for resolving defects and disputes; provisions covering subcontracting, including any security requirements that must flow down; and business continuity, plus termination provisions covering the return or destruction of information and assets when the relationship ends. Programs already writing GDPR Article 28 processor contracts (see GDPR and third-party risk) or offboarding runbooks (see vendor offboarding) are already producing pieces of exactly this list for personal data specifically; 5.20 asks for the same discipline applied to every supplier relationship the security risk assessment flags, not only the ones a privacy regulation happens to name.
5.21 and 5.22: the supply chain and ongoing oversight
5.21 is where Annex A acknowledges that a supplier's own suppliers matter - the same sub-tier visibility problem covered generally in fourth-party risk, applied specifically to ICT products and services. ISO/IEC 27036 Part 3 is the detailed guidance behind 5.21 for hardware, software, and services supply chains; Part 4 is the counterpart for 5.23 and cloud services. 5.22 is the control most often satisfied on paper and not in practice: "regularly monitor, review, and audit" is easy to schedule as an annual calendar entry and much harder to run as an ongoing discipline that catches a supplier's security posture changing between reviews - which is the case this cluster makes generally in continuous vendor monitoring. An SoA that claims 5.22 but points only to a once-a-year vendor review meeting is claiming less oversight than the control's own wording ("regularly monitor") implies.
Turning Annex A 5.19-5.23 into TPRM actions
- Ask for the SoA, not just the certificate. A certificate confirms an audit happened; the SoA tells you what it actually covered and whether 5.19-5.23 were included, excluded, or scoped narrowly.
- Check the edition before accepting anything dated. A certificate still citing ISO/IEC 27001:2013 has been invalid since 31 October 2025 and is itself a finding, not evidence of compliance.
- Use 5.20's guidance list as your own contract checklist, even for vendors you do not require to be ISO 27001 certified - the requirement categories apply regardless of which framework a supplier follows.
- Treat 5.21 as your cue to ask about sub-tier suppliers for any vendor with real supply-chain depth, not just the direct contract counterparty.
- Read 5.22 literally. "Regularly" is not "annually" - pair a certified vendor's own review cadence with independent, continuous signal rather than trusting the certification date alone.
Where this sits among TPRM platforms
Collecting certificates, tracking their editions and expiry, and holding the SoA and supplier-agreement library on file is governance workflow that questionnaire and GRC platforms are built to manage well. What that library does not tell a program is whether a certified vendor's actual, current environment still matches what its last audit described - the same gap this cluster covers generally in evidence-based risk scoring, where externally observed security-rating signal fills in what a filed certificate cannot. Rescana is Fully Autonomous with human in the loop based on preference, pairing that continuous, evidence-based monitoring with automated evidence collection, so a 5.22 review checks a vendor's current posture and certificate validity rather than filing a PDF away until the next scheduled reassessment.
Frequently asked questions
What are the ISO 27001 Annex A supplier relationship controls?
ISO/IEC 27001:2022 Annex A addresses supplier relationships through five controls in its Organizational theme: 5.19 (information security in supplier relationships, the parent objective), 5.20 (information security requirements in supplier agreements), 5.21 (managing information security in the ICT supply chain), 5.22 (monitoring, review, and change management of supplier services), and 5.23 (information security for use of cloud services). Annex A states each control's objective in a sentence or two; ISO/IEC 27002 provides implementation guidance, and ISO/IEC 27036 provides deeper, supplier-relationship-specific guidance for putting the same controls into practice. Part 3 of ISO/IEC 27036 maps onto control 5.21, and Part 4 maps onto control 5.23.
Does an ISO 27001 certificate prove a vendor's supplier-risk controls are adequate?
Not by itself. ISO 27001 certification confirms that an accredited body audited the organization's information security management system against its own Statement of Applicability (SoA) - the document ISO/IEC 27001:2022 clause 6.1.3(d) requires, naming which Annex A controls the organization selected, excluded, and why. The audit tests whether the organization does what its SoA claims, not whether the SoA set a demanding bar. A vendor can hold a valid certificate while having scoped 5.19-5.23 narrowly, or in rare cases excluded them with a documented justification. Ask to see the SoA and the certificate's scope statement, not just the certificate itself, before treating certification as proof of a strong supplier program.
What changed in the ISO 27001 supplier controls between the 2013 and 2022 editions?
Four of the five 2022 supplier controls are a straight renumbering or merger of the 2013 edition's clause A.15: 5.19 was A.15.1.1, 5.20 was A.15.1.2, 5.21 was A.15.1.3, and 5.22 merges A.15.2.1 and A.15.2.2. Control 5.23, information security for use of cloud services, is the only supplier control among the eleven new controls the 2022 revision introduced - it did not exist in the 2013 edition at all. The International Accreditation Forum required all ISO/IEC 27001:2013 certificates to transition to the 2022 edition by 31 October 2025 (IAF MD 26); a certificate still citing the 2013 edition today is no longer valid.
What should an ISO 27001 supplier agreement include under control 5.20?
ISO/IEC 27002's guidance for control 5.20 lists the specific items a supplier agreement should address: a description of the information, product, or service supplied and its classification; applicable legal, regulatory, and contractual requirements including data protection; the supplier's obligation to protect information proportionate to its sensitivity; access and acceptable-use rules; incident management and notification requirements; screening of supplier personnel with sensitive access; a right to audit the supplier's controls; a process for resolving defects and disputes; subcontracting provisions and required security flow-down; and business continuity and termination terms covering the return or destruction of information at the end of the relationship.