Supplier & Third-Party Security Procedure

This procedure defines how your organisation identifies, assesses and manages information security risks arising from suppliers and other third parties, including the ICT supply chain and cloud service providers, in accordance with Annex A controls 5.19–5.23 of ISO/IEC 27001:2022.

What's Inside

• Responsibilities
• Supplier Risk Classification (Annex A 5.19)
• Due Diligence
• Contractual Security Requirements (Annex A 5.20)
• ICT Supply Chain Security (Annex A 5.21)
• Cloud Service Providers (Annex A 5.23)
• Onboarding and Access Provisioning
• Monitoring, Review and Change Management (Annex A 5.22)

ISO 27001 Alignment

Supports ISO/IEC 27001:2022 requirements, including Annex A controls 5.19, 5.20, 5.21, 5.22 and 5.23. It fits with the rest of the QEHS Vault ISO 27001 document set.

Format

Supplied as a fully editable Microsoft Word (.docx) file. Add your organisation’s name, logo and details, then use it straight away. Instant download after purchase.