Key takeaways
- Manage risks in the technology products and services you buy, including their sub-suppliers.
- Your technology supply chain includes software, hardware and cloud components from many sources.
- Start here: identify critical ICT products and services and where they come from.
Purpose
Manage risks in the technology products and services you buy, including their sub-suppliers.
Requirement
Requirement summaryProcesses and procedures shall be defined and implemented to manage the information security risks associated with the ICT products and services supply chain.
Why it matters
Your technology supply chain includes software, hardware and cloud components from many sources. Risks can enter at any link.
How to implement
- Identify critical ICT products and services and where they come from.
- Ask key suppliers how they manage their own sub-suppliers.
- Require secure components such as supported software and signed updates.
- Monitor for supply chain advisories affecting your stack.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.21. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for checking technology suppliers, including the suppliers they rely on.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.21 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Security checks for key technology suppliers that cover their own subcontractors.
- Records of being told about, or approving, a supplier's subcontractors.
Things you should be able to show or explain
- Be able to explain how you judge the risk of new software or services.
How much to show: Two or three key technology suppliers.
Common mistakes
- No idea who your suppliers' subcontractors are.
- New software adopted without any check.
- Ignoring open-source dependencies.
- Not knowing which sub-processors handle your data.
- Tip: Ask key vendors for their certifications and SBOMs where relevant.
Policies & documents to have
- Third-Party Management Policy
FAQ
Is A.5.21 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.21?
Be ready to explain how the control works in your organisation and to provide things like: Your process for checking technology suppliers, including the suppliers they rely on…