Part 34 - A15 Supplier Relationships
Having mutually beneficial supplier relationships is one of the key basics of running any management system. I have previously written about this in my ISO 9001 certification series here. I also wrote about it here and here.
As I said at the time; “Too few organisations make supplier management a priority, but the ones that do reap impressive rewards. Risk is reduced because communication is open and two-way – which means you are much less likely to be caught unawares.”
So for ISO 27001 there is no difference to those principles.
However, Annex A.15 of ISO 27001 takes this a step further and targets some specific areas.
Firstly it looks at Information security in supplier relationships.
A.15.1 Information Security in Supplier Relationships
The objective of this clause is to ensure you protect your organisation’s assets that are accessible by suppliers.
The process for this is to:
- Review all your assets you are managing as part of A8. Asset Management (see here).
- Check that controls for mitigating the risks associated with your supplier’s access to those assets are agreed with the supplier
- Document those agreements.
Here at Mango we documented those supplier interactions and risks and discussed them with the supplier’s management. We then documented those into our supplier agreements. The areas covered the following:
- Supplier access
- Processing facilities
- IT infrastructure components
Next up is supplier service delivery management.
A.15.2 Supplier Service and Delivery Management
The objective here is to maintain your agreed level of information security and service delivery in line with your supplier agreements.
This is closely related to the A.15.1 above.
First up you need to regularly monitor, review and audit supplier service to your business.
Here at Mango monitor performance monthly in our Management Review. We then review and audit the suppliers annually. We have an audit checklist in Mango to do this.
Secondly you need to manage the changes to services by your suppliers. This includes maintaining and improving information security policies, procedures and controls. You need to take into account the criticality of business information, systems and processes involved and re-assessment of risks.
Here at Mango we use our improvement module to manage changes to the provision of service. We check the risks involved and seek signoff along the process.
- Seek to have a mutually beneficial relationship with all your critical suppliers.
- Review all your assets and how your suppliers access and interact with them.
- Check that the controls are agreed with the supplier.
- Document those into agreements with the supplier.
- Monitor and review your supplier’s performance against those agreements.
- Make sure you effectively manage changes with your suppliers.
View previous blogs in this series "ISO 27001 Information Security Management Standard":