Information security in supplier relationships

Why it matters

Your ISMS is only as strong as the weakest vendor holding your data.

How a self-led small team implements it

Keep a simple vendor list noting what data each one touches; don't try to formally assess every SaaS tool on day one.

What auditors expect to see

Vendor/supplier register.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities