ISO 27001 A.5.19: Information Security in Supplier Relationships

Quick Reference (60 Seconds)

ISO 27001:2022 Annex A 5.19 requires organizations to establish and maintain processes for managing information security in supplier relationships, ensuring that suppliers and their services, products, and personnel do not introduce unacceptable risk to the organization's information and systems.

The Bottom Line: You can have the strongest internal security in the world, but one vulnerable supplier can destroy it all. Supplier security is your security. If you don't manage it, you don't own your risk.

What the Standard Actually Requires

The ISO 27001:2022 Text

Annex A 5.19 states:

ISO 27001:2022 Annex A 5.19 asks organizations to define and apply processes and controls to manage the security risks of using suppliers' products and services.

What ISO 27002:2022 Adds

The implementation guidance requires:

• Identification of all suppliers and their access to information/assets
• Risk assessment of suppliers based on access, data handled, criticality, and location
• Security requirements defined and communicated to suppliers before engagement
• Security requirements included in contracts and agreements (A.5.14)
• Monitoring and review of supplier security performance
• Right to audit suppliers and their subcontractors
• Incident notification requirements in contracts
• Change management for supplier services, personnel, and locations
• Termination and return/destruction of information on contract end
• Supplier access revocation procedures
• Due diligence for new suppliers and periodic reassessment
• Management of supplier personnel changes and access

The Six Mandatory Components

Why Information Security in Supplier Relationships Matters

The Supplier Risk Reality

The Indian Context

India's digital economy is deeply intertwined with global and local suppliers. Key factors amplifying supplier risk in India:

1. IT/ITES Hub: India hosts thousands of IT service providers, BPOs, and KPOs handling global customer data. A breach at one Indian supplier can expose data from 50+ international clients.
2. DPDP Act 2023: The Act makes the "data fiduciary" (your organization) liable for breaches, even if caused by a supplier. Section 8(5)'s "reasonable security safeguards" obligation extends to your supply chain.
3. RBI, SEBI, IRDAI mandates: Financial regulators explicitly require vendor risk management. RBI's Master Direction on Digital Payment Security mandates vendor assessments, contractual controls, and incident reporting.
4. Offshoring and outsourcing: Many Indian companies are suppliers to global enterprises, subject to stringent client audits (SOC 2, ISO 27001, PCI DSS). Failing supplier security means losing contracts.
5. SMB supplier ecosystem: Indian SMEs often rely on small local IT vendors, website developers, and accountants who lack security awareness. These are the weakest links.

Scope and Applicability

What Suppliers Are Covered

A.5.19 applies to any external party that has access to the organization's information, systems, or premises. This includes:

Supplier Access Types

Organizational Scope

Key Definitions and Terminology

Relationship to Other Controls

Control A.5.19 is a central organizational control that intersects with nearly every other control in ISO 27001:2022. Supplier relationships are conduits for risk, and their management must be coordinated across the entire standard.

Organizational Controls (5.x)

People Controls (6.x)

Physical Controls (7.x)

Technological Controls (8.x)

The A.5.14 ↔ A.5.19 ↔ A.5.9 (Legacy) Triad

In the 2013 version of ISO 27001, supplier relationships were covered by A.15.1 (Information security in supplier relationships) and A.15.2 (Supplier service delivery management). In 2022, these were consolidated and reorganized:

• A.5.14 (Information transfer agreements): Governs the agreement itself, what must be in the contract
• A.5.19 (Information security in supplier relationships): Governs the ongoing management of supplier security, risk assessment, monitoring, auditing, termination

A.5.19 references A.5.14 for the contractual foundation, but focuses on the process of managing the relationship after the contract is signed. For full compliance, both controls must be implemented together.

Implementation Roadmap (Week-by-Week)

Standard Implementation: 10 Weeks

The following roadmap is designed for growing companies (250-5000 employees) with 50-200 active suppliers. Adjust for smaller or larger organizations.

Accelerated Implementation: 5 Weeks

For organizations with urgent certification deadlines or fewer than 50 suppliers:

Enterprise Implementation: 16 Weeks

For large organizations with 500+ suppliers, global operations, multiple procurement teams, and complex subcontractor chains:

Detailed Implementation Guidance

Step 1: Supplier Inventory, Know Your Suppliers

You cannot manage what you do not know. The first step is a complete inventory of all suppliers with access to your information, systems, or premises.

Inventory Sources:

• Accounts payable / finance records (all paid vendors)
• Procurement system / contract database
• IT system access logs (who has VPN, RDP, admin accounts?)
• Cloud admin consoles (who has IAM access?)
• Physical access logs (visitor management, security passes)
• Email domain analysis (who is on your distribution lists?)
• Department interviews (ask each department who they share data with)
• SaaS subscription discovery (use tools like Productiv, Torii, or manual survey)

Inventory Attributes:

Shadow Supplier Discovery:

Shadow suppliers are vendors engaged by individual departments without procurement or security knowledge. Common examples:

• Marketing team using a freelance designer with Google Drive access to brand assets
• Sales team using a personal CRM subscription with customer data
• Developer using a personal GitHub account for company code
• HR using a free survey tool for employee feedback with PII

Discovery techniques:

1. Expense report analysis (look for SaaS subscriptions, freelance payments)
2. Email domain analysis (which external domains appear in internal distribution lists?)
3. Cloud access logs (which external IPs access your cloud?)
4. Department surveys ("List all external parties with access to your data")
5. Network traffic analysis (which SaaS APIs are your systems calling?)

Step 2: Supplier Risk Classification, Tier Your Suppliers

Not all suppliers are equal. Risk-based tiering ensures you focus your limited resources on the suppliers that matter most.

Tiering Criteria:

Risk Tier Definitions:

Step 3: Supplier Security Assessment, Evaluate Before You Trust

The Security Questionnaire (SSQ):

A well-designed SSQ covers 8 domains:

SSQ Response Evaluation:

Alternative Assessment Methods:

Step 4: Contractual Security Requirements, Put It in Writing

Security requirements that are not in the contract are not enforceable. Every supplier contract must include a security addendum or embedded security clauses.

Mandatory Contract Clauses for Critical/High Suppliers:

Clause Library by Supplier Type:

Step 5: Supplier Monitoring, Trust but Verify

Signing a contract with security clauses is not enough. You must monitor the supplier's ongoing compliance.

Monitoring Methods by Tier:

Continuous Monitoring Techniques:

1. Security Rating Services: BitSight, SecurityScorecard, UpGuard, or Panorays provide daily security ratings based on external telemetry (open ports, malware, SSL certificates, breach history). Use for all Critical and High suppliers.

2. Certificate Monitoring: Track ISO 27001, SOC 2, PCI DSS certification expiry dates. Set alerts 90 days before expiry.

3. Security News Monitoring: Google Alerts, Feedly, or vendor-specific threat intelligence for supplier breach news. A supplier breach may expose your data even if they don't notify you proactively.

4. Log Monitoring: If suppliers have VPN or system access, monitor their access logs for anomalies: unusual hours, geolocation changes, excessive data download, privilege escalation.

5. Vulnerability Scanning: Scan supplier-facing assets (APIs, portals, integrations) for vulnerabilities. If their infrastructure is weak, your connection is at risk.

6. Dark Web Monitoring: Monitor for leaked credentials, data, or intellectual property related to your supplier relationships.

7. Quarterly Business Reviews (QBR): For Critical suppliers, include a standing security agenda: incident review, patch status, access review, certification status, subcontractor changes.

Step 6: Supplier Audit, See for Yourself

Audit Planning:

Audit Checklist (Critical Supplier):

Step 7: Incident Management with Suppliers

Supplier Incident Response Protocol:

1. Detection: Your SOC detects anomalous activity from a supplier account, or you receive a supplier breach notification, or you read about a supplier breach in the news.

2. Notification Verification: Contact the supplier's security team immediately. Verify the scope: what data, what systems, what timeframe, what is the root cause.

3. Impact Assessment: Determine if your data, systems, or customers are affected. Classify the incident internally per your incident response plan.

4. Containment:

   • Disable supplier accounts if compromise is confirmed
   • Revoke API keys, certificates, or VPN access
   • Isolate supplier-connected systems if necessary
   • Engage the supplier's incident response team for joint containment

5. Eradication: Work with the supplier to ensure the root cause is fixed. Require evidence of remediation before re-enabling access.

6. Recovery: Re-enable access under heightened monitoring. Conduct a security review of the supplier's improved controls.

7. Post-Incident:

   • Update the supplier risk assessment
   • Consider contract termination if the breach was due to gross negligence
   • Update your incident response playbook with lessons learned
   • Notify regulators if required (DPDP Act: 72 hours; RBI: 6 hours for payment incidents)
   • Notify affected customers if personal data was compromised

Step 8: Change Management, When Suppliers Change

Supplier changes that must trigger a reassessment:

Step 9: Termination and Offboarding, Close Securely

Termination Triggers:

• Contract natural expiry
• Early termination for convenience
• Termination for breach (including security breach)
• Supplier insolvency or business closure
• Service consolidation or replacement

Offboarding Checklist:

Data Destruction Verification:

For Critical suppliers handling sensitive data, do not trust a self-signed certificate of destruction. Require:

• Detailed destruction methodology (NIST 800-88 Clear, Purge, or Destroy)
• Third-party attestation or audit of destruction
• Sample verification (if contract allows, request proof for a sample of records)
• Chain of custody documentation for data transfer before destruction

Tools, Technologies, and Solutions

Third-Party Risk Management (TPRM) Platforms

Contract and Procurement Tools

Discovery and Monitoring Tools

Indian Market Considerations

Policy and Procedure Templates

Supplier Security Policy (Template Outline)

1. Purpose and Scope
   1.1 Purpose: Define requirements for managing information security in all supplier relationships
   1.2 Scope: All suppliers with access to information, systems, or premises
   1.3 Applicability: All procurement, IT, security, facilities, and business teams

2. Roles and Responsibilities
   2.1 CISO: Accountable for supplier security framework; approves Critical supplier engagements
   2.2 Vendor Risk Manager: Responsible for TPRM program execution; assessments; monitoring; audits
   2.3 Procurement: Responsible for including security clauses in contracts; enforcing procurement process
   2.4 Legal: Responsible for contract security clause drafting; enforcement; termination
   2.5 IT / Security Operations: Responsible for supplier access provisioning; monitoring; revocation
   2.6 Data Owners: Responsible for defining data protection requirements for suppliers
   2.7 Business Units: Responsible for identifying and registering all suppliers

3. Supplier Classification and Risk Tiering
   3.1 Classification criteria (data, access, criticality, maturity, subcontractors)
   3.2 Four-tier system: Critical, High, Medium, Low
   3.3 Classification authority and review frequency

4. Supplier Security Assessment
   4.1 Timing: Before contract signing; periodic reassessment
   4.2 Methodology: SSQ + external ratings + audits
   4.3 Evaluation criteria and scoring
   4.4 Exception handling and risk acceptance

5. Contractual Security Requirements
   5.1 Mandatory clauses for each tier
   5.2 Data protection addendum requirements
   5.3 Subcontractor control clauses
   5.4 Right to audit and inspection
   5.5 Incident notification and response
   5.6 Termination and data return

6. Supplier Monitoring and Review
   6.1 Monitoring frequency by tier
   6.2 Continuous monitoring techniques
   6.3 Quarterly business review requirements
   6.4 Security news and alert monitoring

7. Supplier Audit Program
   7.1 Audit frequency by tier
   7.2 Audit planning and notification
   7.3 Audit scope and checklist
   7.4 Finding remediation and follow-up

8. Supplier Change Management
   8.1 Changes requiring notification
   8.2 Reassessment triggers
   8.3 Contract amendment process

9. Supplier Incident Management
   9.1 Incident notification requirements
   9.2 Joint response protocol
   9.3 Root cause analysis and remediation
   9.4 Contract termination for security cause

10. Supplier Termination and Offboarding
    10.1 Termination triggers
    10.2 Offboarding checklist and timeline
    10.3 Data return and destruction verification
    10.4 Access revocation procedures
    10.5 Post-termination review

11. Subcontractor and Fourth-Party Risk
    11.1 Disclosure requirements
    11.2 Assessment obligations
    11.3 Liability and control

12. Training and Awareness
    12.1 Procurement training on security clauses
    12.2 Business unit training on supplier registration
    12.3 Security team training on TPRM

13. Compliance and Audit
    13.1 Internal audit requirements
    13.2 Evidence retention
    13.3 Non-conformance handling

14. Policy Review
    14.1 Annual review cycle
    14.2 Trigger-based review (incident, regulation, breach)

Supplier Security Procedure (Template Outline)

Procedure: SUP-SEC-001 Supplier Security Management Lifecycle

1. Supplier Identification and Registration
   Step 1: Business unit identifies supplier need
   Step 2: Procurement requests supplier registration
   Step 3: Supplier completes registration form with access and data details
   Step 4: Supplier added to inventory with unique ID
   Step 5: Initial classification (Low default until assessment)

2. Pre-Engagement Assessment
   Step 6: Vendor Risk Manager classifies supplier based on registration data
   Step 7: For Critical/High: Full SSQ + external rating + certification review
   Step 8: For Medium: Standard SSQ + certification review
   Step 9: For Low: Light attestation or certification check
   Step 10: Risk assessment completed and scored
   Step 11: Risk treatment plan defined if gaps exist
   Step 12: Security approval obtained before contract

3. Contracting
   Step 13: Legal includes security clauses based on tier
   Step 14: Data Owner confirms data protection requirements
   Step 15: CISO approves Critical/High supplier contracts
   Step 16: Contract signed and archived with security addendum

4. Onboarding and Access Provisioning
   Step 17: IT provisions access per least privilege principle
   Step 18: MFA enforced for all logical access
   Step 19: Physical access provisioned (if applicable) with escort/area restrictions
   Step 20: Supplier personnel complete security awareness training
   Step 21: Supplier added to monitoring and alert systems

5. Ongoing Monitoring
   Step 22: Monthly QBR for Critical suppliers (security agenda)
   Step 23: Quarterly review for High suppliers
   Step 24: Bi-annual review for Medium suppliers
   Step 25: Annual light review for Low suppliers
   Step 26: Continuous monitoring via security ratings and news alerts
   Step 27: Access reviews quarterly for Critical/High suppliers

6. Audit
   Step 28: Annual on-site audit for Critical suppliers
   Step 29: Bi-annual virtual audit for High suppliers
   Step 30: Audit findings documented; CAP issued; follow-up scheduled

7. Change Management
   Step 31: Supplier notifies of material change
   Step 32: Vendor Risk Manager evaluates change impact
   Step 33: Reassessment conducted if required
   Step 34: Contract amended if required
   Step 35: Updated monitoring scope applied

8. Incident Response
   Step 36: Incident detected or reported by supplier
   Step 37: Impact assessment conducted
   Step 38: Containment actions executed (access revocation if needed)
   Step 39: Joint investigation with supplier
   Step 40: Root cause analysis and remediation verification
   Step 41: Risk assessment updated; contract termination considered if negligence

9. Termination and Offboarding
   Step 42: Termination triggered (expiry, convenience, breach)
   Step 43: Termination notice issued
   Step 44: All access revoked within 24 hours
   Step 45: Data return requested and verified
   Step 46: Destruction certificate obtained and verified
   Step 47: Assets collected and accounted for
   Step 48: Supplier removed from inventory and monitoring
   Step 49: Lessons learned captured

Supplier Security Questionnaire (SSQ) Template (Excerpt)

SUPPLIER SECURITY QUESTIONNAIRE
Supplier Name: _________________________
Assessment Date: _________________________
Assessed By: _________________________
Risk Tier: _________________________

SECTION A: GOVERNANCE AND POLICY (10 points)
A1. Do you have a documented information security policy?
    □ Yes, approved by management, reviewed annually
    □ Yes, but not reviewed recently
    □ No
A2. Do you have a dedicated security function or CISO?
    □ Yes, full-time CISO or security team
    □ Yes, part-time or outsourced
    □ No
A3. Have you achieved any of the following certifications?
    □ ISO 27001 (current) — provide certificate
    □ SOC 2 Type II (current) — provide report
    □ PCI DSS (if applicable) — provide AOC
    □ None

SECTION B: ACCESS CONTROL (15 points)
B1. Do you enforce Multi-Factor Authentication (MFA) for all administrative access?
    □ Yes, for all admin accounts
    □ Yes, for some admin accounts
    □ No
B2. How frequently do you review user access rights?
    □ Quarterly or more frequently
    □ Annually
    □ Ad-hoc or never
B3. Do you maintain a principle of least privilege for all users?
    □ Yes, enforced and audited
    □ Yes, but not formally audited
    □ No

SECTION C: DATA PROTECTION (20 points)
C1. Is our data encrypted at rest? Algorithm?
    □ AES-256 or equivalent
    □ AES-128 or equivalent
    □ No encryption
C2. Is our data encrypted in transit? Protocol?
    □ TLS 1.3 or equivalent
    □ TLS 1.2
    □ Unencrypted or TLS 1.0/1.1
C3. Do you have a data retention and destruction policy?
    □ Yes, documented and enforced
    □ Yes, but not enforced
    □ No

SECTION D: INCIDENT MANAGEMENT (15 points)
D1. Do you have an incident response plan?
    □ Yes, documented, tested, and maintained
    □ Yes, but not tested
    □ No
D2. What is your incident notification timeframe to customers?
    □ Within 24 hours
    □ Within 72 hours
    □ Within 1 week
    □ No defined timeframe
D3. How many security incidents did you experience in the last 12 months?
    □ 0
    □ 1-2
    □ 3-5
    □ More than 5

SECTION E: BUSINESS CONTINUITY (10 points)
E1. What is your Recovery Time Objective (RTO)?
    □ < 4 hours
    □ < 24 hours
    □ < 72 hours
    □ > 72 hours or no RTO
E2. When was your last disaster recovery test?
    □ Within 6 months
    □ Within 12 months
    □ > 12 months ago
    □ Never

SECTION F: SUBCONTRACTORS (10 points)
F1. Do you use subcontractors for services related to our data?
    □ No
    □ Yes — list attached
    □ Yes — but not disclosed
F2. Do you assess your subcontractors' security?
    □ Yes, same standard as our own
    □ Yes, but less rigorously
    □ No

SECTION G: COMPLIANCE AND AUDIT (10 points)
G1. When was your last external security audit?
    □ Within 12 months
    □ Within 24 months
    □ > 24 months ago
    □ Never
G2. Are you willing to provide audit reports or undergo our audit?
    □ Yes, fully cooperative
    □ Yes, with restrictions
    □ No

SECTION H: REGULATORY (10 points)
H1. Are you familiar with the Digital Personal Data Protection Act 2023 (India)?
    □ Yes, and we comply
    □ Yes, but not fully compliant
    □ No
H2. Can you store and process all our data within India?
    □ Yes
    □ Yes, with some exceptions (specify)
    □ No

SCORING:
Total Score: ___ / 100
Rating: □ Excellent (90-100) □ Good (70-89) □ Fair (50-69) □ Poor (30-49) □ Unacceptable (<30)

Risk Assessment and Treatment

Supplier Risk Assessment Methodology

Step 1: Inherent Risk Assessment

Inherent risk is the risk before considering the supplier's controls. It is determined by what the supplier does, not how well they do it.

Step 2: Control Effectiveness Assessment

Evaluate the supplier's security controls based on SSQ, certifications, and external ratings.

Step 3: Residual Risk Calculation

Residual Risk = Inherent Risk × (1 - Control Effectiveness/5)

Sample Supplier Risk Register

Risk Treatment Options

Audit and Compliance Checklist

Use this checklist during internal audits, certification audits, and customer audits. Each question should be answered with evidence.

Policy and Governance (5 questions)

Risk Assessment and Contracting (6 questions)

Monitoring and Audit (6 questions)

Change and Incident Management (5 questions)

Termination and Offboarding (5 questions)

Subcontractor and Fourth-Party Risk (3 questions)

Metrics and KPIs

Supplier Security KPIs

KPI Dashboard Layout

SUPPLIER SECURITY DASHBOARD — June 2026
========================================

Active Suppliers: 187
Critical: 12 | High: 34 | Medium: 78 | Low: 63
New This Month: 5 | Terminated This Month: 2

COVERAGE METRICS
- Inventory Coverage: 100% (187/187) ✓
- Risk Assessment Completion: 98% (183/187) ⚠️
- Security Clause Coverage: 97% (181/187) ⚠️
- DPA Coverage: 100% (45/45) ✓

QUALITY METRICS
- Audit Execution Rate: 100% (8/8) ✓
- Access Review Completion: 100% (46/46) ✓
- Offboarding Compliance: 100% (2/2) ✓

RISK METRICS
- Supplier Incidents (MTD): 1 (Medium severity, contained) ⚠️
- Security Rating Trend: Stable (avg 78/100)
- Shadow Suppliers Discovered: 0 ✓

ACTIONS
1. Complete risk assessment for 4 pending Medium suppliers (SUP-184 to SUP-187)
2. Renegotiate security clauses with 6 suppliers missing data residency terms
3. Schedule Q3 audit for SUP-012 (CloudServe India) — certificate expiry approaching

Common Pitfalls and How to Avoid Them

The 15 Most Common Pitfalls

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Growing SaaS Company, Building TPRM from Scratch

Organization: CloudCraft Solutions Pvt. Ltd., a Hyderabad-based SaaS company with 320 employees, providing project management software to 4,000+ SMB customers in India and Southeast Asia. Annual revenue: .

Challenge:

• 85 active suppliers, but no formal inventory; estimated 30+ shadow suppliers
• Preparing for first SOC 2 Type II audit and ISO 27001 certification
• No security clauses in 60% of contracts
• Customer audit from a large enterprise client identified supplier security gaps
• Budget: for TPRM program setup

Implementation Steps:

Step 1, Supplier Discovery (Week 1): Singahi conducted a complete discovery:

• Finance record analysis: 87 paid vendors in last 12 months
• IT access log analysis: 23 external accounts with system access
• Cloud IAM analysis: 12 external IAM users in AWS
• Department survey: 15 additional suppliers not in finance records
• Total discovered: 107 suppliers (22 more than initially known)

Step 2, Classification and Tiering (Week 2): Using the risk framework:

• Critical: 8 (cloud hosting, payment gateway, core development vendor, customer support BPO)
• High: 18 (CRM, email, backup, legal, accounting, major IT consultants)
• Medium: 35 (marketing tools, recruitment, training, minor consultants)
• Low: 46 (office supplies, couriers, travel, minor services)

Step 3, Policy and Templates (Week 3): Singahi delivered:

• Supplier Security Policy (aligned with DPDP Act 2023, SOC 2, and ISO 27001)
• Tiered contract clause library (Critical: 15 clauses; High: 12 clauses; Medium: 8 clauses; Low: 4 clauses)
• Standard Supplier Security Questionnaire (SSQ) with 80 questions across 8 domains
• Offboarding checklist with 15 tasks and evidence requirements

Step 4, Critical Supplier Assessment (Weeks 4-5): All 8 Critical suppliers assessed:

• Cloud hosting provider (AWS India): ISO 27001 + SOC 2; score 94/100, Excellent
• Payment gateway (Razorpay): PCI DSS Level 1; score 91/100, Excellent
• Core development vendor (Bengaluru ODC): No ISO 27001; score 58/100, Fair
• Customer support BPO (Chennai): No certifications; score 45/100, Poor
• Backup provider: ISO 27001; score 88/100, Good
• Email/SaaS provider (Google Workspace): SOC 2; score 95/100, Excellent
• CDN/WAF provider (Cloudflare): SOC 2; score 92/100, Excellent
• Penetration testing vendor (Astra Security): ISO 27001; score 89/100, Good

Step 5, Remediation and Contract Amendments (Weeks 6-8):

• Core development vendor: Required to achieve ISO 27001 within 12 months; interim: enhanced monitoring, quarterly SSQ, mandatory SAST/DAST on all deliverables, secure coding training for 20 developers. Contract amended with security addendum and liability cap.
• Customer support BPO: Required to implement MFA, quarterly access reviews, incident notification within 24 hours, and annual pen test. Contract amended with security milestones and right to audit. Score improved to 68/100 within 6 months.
• All 8 Critical suppliers: Contract amendments signed with new security clauses.
• High suppliers: Batch contract review; 14 of 18 amended successfully; 4 in negotiation.

Step 6, Monitoring Setup (Week 9):

• Subscribed to SecurityScorecard for 8 Critical + 10 High suppliers (/year)
• Configured Google Alerts for all 107 suppliers
• Quarterly Business Review (QBR) calendar established for Critical suppliers
• Access review calendar: quarterly for Critical/High; bi-annual for Medium

Step 7, Offboarding Test (Week 10): Tested offboarding with 1 departing Low supplier:

• Access revoked in 4 hours (exceeded 24-hour target)
• Data return: 500 GB of backup logs transferred and verified
• Destruction certificate obtained
• Lessons learned: improve asset collection process for remote suppliers

Step 8, Training and Rollout (Week 11):

• Procurement team trained on security clause library and approval workflow (4 hours)
• IT team trained on access provisioning and revocation procedures (2 hours)
• Business unit heads trained on supplier registration requirement (1 hour)
• Policy communicated to all 107 suppliers via email with acknowledgment request

Outcome:

• SOC 2 Type II audit (Month 6): zero exceptions in the vendor management trust services criteria
• ISO 27001 Stage 2 audit (Month 8): zero major non-conformities in A.5.19; one minor (missing access review for 1 Medium supplier, fixed in 48 hours)
• Customer audit from large enterprise client: passed with commendation for "mature TPRM for company size"
• Total investment: (under budget)
• Supplier security incidents in first 12 months: 1 (supplier phishing attempt; contained within 2 hours due to monitoring)
• Core development vendor achieved ISO 27001 certification in Month 10
• CloudCraft's TPRM program became a reference model for 3 peer companies in their Hyderabad tech cluster

Key Lessons:

1. Growing SaaS companies can build effective TPRM in 10-12 weeks with focused effort and templates
2. Shadow supplier discovery is critical, 20% of suppliers were invisible before the program
3. Tiered contract clauses are essential, one-size-fits-all contracts leave gaps or create unnecessary burden
4. Security rating platforms provide continuous visibility at reasonable overhead for growing companies
5. Customer audits are powerful motivators, use them to justify TPRM investment to management

Illustrative Scenario 2: Large Indian Enterprise Bank, Enterprise TPRM Transformation

Organization: Bharat National Bank (BNB), a Mumbai-headquartered public sector bank with 28,000 employees, 4,500 branches, 12,000 ATMs, and total assets of . Regulated by RBI under the Banking Regulation Act.

Challenge:

• 2,400+ active suppliers across IT, facilities, professional services, BPO, ATM maintenance, cash logistics, and consulting
• RBI Master Direction on Digital Payment Security mandates complete vendor risk management
• 200+ Critical suppliers with access to core banking systems, payment networks, and customer data
• Legacy TPRM process was manual, spreadsheet-based, and conducted annually, inadequate for current threat landscape
• Multiple audit findings: inconsistent supplier assessments, missing security clauses, no continuous monitoring, delayed incident notification
• Budget: for TPRM transformation over 18 months

Implementation Steps:

Step 1, Program Establishment (Months 1-2): Singahi established a dedicated Vendor Risk Management (VRM) function:

• Hired Vendor Risk Manager (reporting to CISO)
• 4 Vendor Risk Analysts (2 for Critical, 2 for High)
• Governance: Monthly VRM Committee with CISO, CIO, CRO, Head of Procurement, and Head of Legal
• Policy: Complete rewrite of Supplier Security Policy with RBI-specific requirements

Step 2, Enterprise Inventory and Discovery (Months 2-4):

• Migrated from spreadsheets to OneTrust Vendorpedia TPRM platform (/year)
• Integrated with SAP Ariba (procurement) for automatic supplier registration
• Integrated with Active Directory and VPN logs for access-based supplier discovery
• Integrated with AWS, Azure, and GCP IAM for cloud-based supplier discovery
• Final inventory: 2,847 suppliers (447 more than previously known)
• Shadow supplier reduction: 78% of newly discovered suppliers registered within 60 days

Step 3, Risk Classification at Scale (Months 3-5):

• Automated risk scoring based on: data sensitivity, system access, annual spend, certification status, location
• Critical: 247 (up from 200 due to better visibility)
• High: 512
• Medium: 1,034
• Low: 1,054

Step 4, Assessment Automation (Months 4-8):

• Automated SSQ distribution via OneTrust to all 2,847 suppliers
• 78% response rate within 30 days; follow-up for non-responders
• External security ratings (BitSight) integrated for all Critical and High suppliers
• Automated risk score calculation: inherent risk × control effectiveness
• 312 suppliers flagged for remediation; 18 flagged for potential termination

Step 5, Contract Remediation at Scale (Months 6-12):

• Legal team engaged in largest contract remediation effort in bank history
• 2,100 contracts reviewed; 1,680 required amendment
• Critical suppliers: 100% amended with full security addendum (15 clauses + RBI-specific requirements)
• High suppliers: 85% amended; 15% in negotiation or replacement
• New contract template: Security addendum is mandatory; no PO issued without security sign-off from VRM
• Data residency clause: All customer financial data must remain in India; no cross-border processing without RBI approval and explicit customer consent

Step 6, Continuous Monitoring (Months 8-14):

• BitSight ratings reviewed daily for Critical; weekly for High
• Automated alerts for: certification expiry, rating drop >20 points, breach news, dark web mentions
• Monthly QBRs for all 247 Critical suppliers with standard security agenda
• Quarterly access reviews for all Critical/High supplier accounts
• Penetration testing of supplier-facing APIs and portals: quarterly

Step 7, Audit Program (Months 10-16):

• 50 on-site audits conducted for Critical suppliers (ATM maintenance, cash logistics, core banking integrators, cloud providers)
• 120 virtual audits conducted for High suppliers
• Average audit overhead: per on-site; per virtual
• Total audit findings: 340; 98% closed within 90 days; 2% escalated to contract termination
• Subcontractor audits: 15 audits of subcontractor facilities (primarily offshore development centers and BPOs)

Step 8, Incident Response Integration (Months 12-16):

• Joint incident response protocol established with top 20 Critical suppliers
• 24/7 security contact matrix with escalation paths
• Supplier incident tabletop exercise: conducted quarterly with 3 suppliers rotating per quarter
• Actual incident during Month 14: BPO supplier detected unauthorized access attempt; notified BNB within 4 hours; joint containment within 2 hours; no data exposure; supplier's access suspended for 48 hours pending investigation; root cause: supplier employee credential phishing; supplier enhanced MFA and training; relationship continued with enhanced monitoring

Step 9, Termination and Offboarding Hardening (Months 14-16):

• Automated offboarding workflow in ServiceNow: termination trigger → access revocation tickets → data return tracking → certificate verification
• 12 suppliers terminated during program (security cause: 3; business: 9)
• Average offboarding time: 18 hours for access revocation; 14 days for data return/destruction
• 100% of terminations completed with full evidence package

Step 10, Regulatory Compliance and Certification (Months 16-18):

• RBI inspection (Month 17): VRM program reviewed; zero adverse findings; commended for "strong vendor risk management among public sector banks"
• ISO 27001 surveillance audit (Month 18): zero non-conformities in A.5.19 and A.5.14
• Internal audit: VRM program maturity rated Level 4 (Managed) on the CMMI scale

Outcome:

• Supplier security incidents: 3 in 18 months (all detected and contained within 4 hours due to monitoring)
• Estimated breach overhead avoided: (based on average financial sector breach overhead in India)
• Audit findings pre-program: 47 annually; post-program: 3 annually (93% reduction)
• Customer trust: 2 major enterprise clients renewed contracts citing "strong supplier security governance" as a factor
• Total investment: (under budget); ROI: 13x based on avoided breach overhead alone
• BNB's VRM program became a illustrative scenario in RBI's industry guidance circular on vendor risk management

Key Lessons:

1. Enterprise TPRM requires dedicated technology, manual spreadsheets do not scale beyond 100 suppliers
2. Procurement system integration is essential for preventing shadow suppliers and enforcing security gates
3. RBI-regulated banks must go beyond ISO 27001 minimums; regulator expectations are higher than standard
4. Subcontractor audits are non-negotiable for Critical suppliers in BFSI, 15% of audit findings were in subcontractor facilities
5. Automated offboarding is critical at scale, manual processes fail under volume and time pressure
6. The investment in TPRM () is insignificant compared to the impact of a single supplier-related breach in banking (+ Crore)

Multi-Framework Mapping

ISO 27001:2022 ↔ SOC 2 ↔ PCI DSS ↔ NIST 800-53 ↔ CIS Controls ↔ COBIT 2019 ↔ GDPR/DPDP

Detailed Control Mapping

ISO 27001 A.5.19 → NIST 800-53 Rev 5:

ISO 27001 A.5.19 → CIS Controls v8:

ISO 27001 A.5.19 → COBIT 2019:

Regulatory and Industry Context

India-Specific Regulations

International Regulations

Industry-Specific Context

Roles and Responsibilities (RACI)

Supplier Security Activities RACI Matrix

Legend:

• R = Responsible (does the work)
• A = Accountable (ultimately answerable; approves)
• C = Consulted (provides input)
• I = Informed (kept updated)

Role Descriptions

Documentation and Evidence Requirements

Mandatory Evidence by TPRM Lifecycle Phase

Evidence Organization

For audit readiness, organize evidence in a structured repository:

/TPRM-Evidence/
  /YYYY/
    /Supplier-Assessments/
      /Critical/
        - [Supplier-ID]-[Name]-Assessment-YYYY-MM-DD.pdf
      /High/
      /Medium/
      /Low/
    /Contracts/
      /Critical/
        - [Supplier-ID]-[Name]-Contract-vX.pdf
      /High/
      /Medium/
      /Low/
    /Monitoring/
      /QBR-Minutes/
      /Security-Ratings/
      /Access-Reviews/
    /Audits/
      /On-Site/
      /Virtual/
      /CAPs/
    /Incidents/
      /YYYY-MM-Incident-[ID]-[Supplier-Name]/
    /Terminations/
      /YYYY-MM-[Supplier-Name]/
    /Governance/
      /Committee-Minutes/
      /Management-Reviews/
      /KPI-Dashboards/
    /Training/
      /Procurement-Training/
      /Supplier-Training/

Continuous Improvement

The Continuous Improvement Cycle for Supplier Security

Plan → Do → Check → Act

Plan:

• Review TPRM metrics quarterly: incident trends, assessment coverage, audit findings, monitoring effectiveness
• Benchmark against industry standards (Gartner TPRM maturity, Shared Assessments SIG, NIST CSF supply chain)
• Identify regulatory changes (DPDP amendments, RBI circulars, new SEBI requirements)
• Update risk framework based on new threat intelligence (supply chain attacks, new vulnerabilities)

Do:

• Deploy updated templates, clauses, and procedures to procurement and security teams
• Train new staff and refresh existing staff on TPRM practices
• Implement new monitoring tools or automation
• Pilot new assessment techniques (e.g., AI-assisted risk scoring, automated evidence collection)

Check:

• Measure KPIs before and after changes
• Conduct internal audit of TPRM program effectiveness
• Gather feedback from suppliers on assessment process (friction vs. value)
• Review post-incident data for supplier root causes

Act:

• Standardize improvements that prove effective
• Eliminate redundant assessments or processes that add no value
• Update knowledge base and playbook
• Report improvements to management and incorporate into governance

Supplier Security Maturity Model

Improvement Triggers and Actions

FAQ

General Questions

Q1: Does A.5.19 apply to all suppliers, including small ones like office supply vendors? A: Yes, but with proportionate effort. A.5.19 applies to all suppliers with access to information, systems, or premises. However, a courier service or office supply vendor (Low tier) requires only a lightweight assessment (e.g., a 4-clause contract and basic security awareness). A cloud hosting provider (Critical tier) requires deep due diligence, continuous monitoring, and annual audits. The key is that no supplier is exempt from the inventory and some level of security consideration.

Q2: What is the difference between A.5.19 and A.5.14? A: A.5.14 (Information transfer agreements) governs the contractual structure for information transfers, what must be in the agreement. A.5.19 governs the ongoing management of supplier relationships, risk assessment, monitoring, auditing, incident management, and termination. A.5.19 references A.5.14 for the contractual foundation, but focuses on the process of managing the relationship after the contract is signed. For full compliance, implement both together.

Q3: Do we need to audit every supplier? A: No. Audits are resource-intensive and should be risk-based. Singahi recommends: annual on-site audits for Critical suppliers, biennial virtual audits for High suppliers, and ad-hoc or incident-driven audits for Medium and Low suppliers. If a supplier holds a current ISO 27001 or SOC 2 Type II certification, you can rely on that (with spot checks) rather than conducting a full audit.

Q4: How do we manage fourth-party risk (our supplier's suppliers)? A: Fourth-party risk is managed through: (1) contractual disclosure requirements, your supplier must tell you who their subcontractors are; (2) contractual liability, your supplier remains liable for subcontractor breaches; (3) assessment of subcontractors for Critical suppliers; (4) security ratings that may capture fourth-party telemetry; (5) limiting the subcontractor chain, require approval for new subcontractors. Full fourth-party visibility is difficult but essential for Critical suppliers.

Q5: Can we accept a supplier without ISO 27001 or SOC 2? A: Yes, but with enhanced scrutiny. Certifications are evidence of a mature security program, but they are not mandatory for A.5.19 compliance. If a supplier lacks certifications, require: a detailed SSQ, evidence of equivalent controls, a remediation plan for gaps, increased monitoring, and potentially a shorter contract term with renewal contingent on improvement. For Critical suppliers, consider requiring certification within 12-24 months as a contract milestone.

Q6: How often should we reassess suppliers? A: Reassessment frequency should align with risk tier: Critical suppliers annually (or more frequently if incidents occur); High suppliers every 18-24 months; Medium suppliers every 2-3 years; Low suppliers every 3 years or on renewal. In addition, reassess whenever there is a material change (subcontractor, location, technology, certification lapse, or incident).

Q7: What is a "shadow supplier" and how do we find them? A: A shadow supplier is a vendor engaged by individual employees or departments without procurement or security knowledge. Examples: a marketing manager's personal Canva subscription with company logos, a developer's personal GitHub account with company code, a department's free survey tool with employee feedback. Find them through: expense report analysis, cloud IAM audits, email domain analysis, network traffic monitoring, and department surveys. Shadow suppliers are a major audit failure point because they bypass all security controls.

Q8: How do we handle supplier security for international vendors (e.g., AWS, Google, Salesforce)? A: Global hyperscalers (AWS, Azure, Google Cloud) typically have strong security programs (ISO 27001, SOC 2, PCI DSS). Your assessment should focus on: shared responsibility model clarity (what they secure vs. what you secure), data residency and region selection, IAM configuration, encryption key management, and their incident notification process. For smaller international vendors, apply the same risk-based assessment as domestic vendors, with additional attention to data residency and cross-border transfer compliance (DPDP Act 2023, GDPR).

Q9: Should we include physical security suppliers (guards, cleaning) in our TPRM program? A: Yes. Physical security suppliers have access to your premises, devices, and sometimes documents. They should be in your inventory, classified (typically Medium), and subject to background checks, physical access controls, and confidentiality agreements. A cleaning crew with after-hours access to executive offices can be a significant insider threat if not managed.

Q10: How does A.5.19 relate to DPDP Act 2023 compliance? A: The DPDP Act 2023 makes the "data fiduciary" (your organization) liable for breaches, even if caused by a supplier (data processor). Section 8(5) requires "reasonable security safeguards" that extend to your supply chain. For any supplier processing personal data on your behalf, you must have a Data Processing Agreement (DPA) with security clauses, verify their safeguards, and ensure they can meet breach notification requirements. Failing to manage supplier security under DPDP can result in fines up to .

Q11: What is the minimum viable TPRM process for a 30-person startup? A: For startups, keep it lean: (1) List all suppliers with access to your data/systems (even the free ones), (2) Classify into Critical (cloud, payment, core dev) and Other, (3) Use standardized security clauses for Critical suppliers (use our clause library), (4) Require MFA and data residency for Critical, (5) Revoke access immediately when a supplier is no longer needed, (6) Monitor for breach news. As you grow, add formal assessments, monitoring tools, and audit programs.

Q12: How do we justify TPRM investment to management? A: Use the business case: (1) 62% of breaches involve suppliers, the risk is real, (2) DPDP Act fines up to, regulatory liability is personal and organizational, (3) enterprise clients require supplier security evidence, revenue depends on it, (4) breach overhead averages M for third-party breaches, prevention is cheaper, (5) TPRM program overhead is typically 0.5-2% of IT spend, negligible compared to breach overhead. Use illustrative scenarios (Section 15) to show peer examples.

Q13: Can we use a single security questionnaire for all suppliers? A: A single complete SSQ can be used, but the evaluation should be tiered. All suppliers answer the same questions, but the pass threshold and required evidence vary by tier. For Low suppliers, a score of 50/100 may be acceptable. For Critical suppliers, 80/100 is the minimum. Alternatively, use a lightweight SSQ for Low/Medium and a complete SSQ for Critical/High. The key is consistency and proportionality.

Q14: What should we do if a Critical supplier refuses to allow an audit? A: If a Critical supplier refuses an audit, you have three options: (1) Accept the risk with formal risk acceptance and enhanced monitoring (not recommended for highly sensitive data), (2) Require an alternative assurance (e.g., SOC 2 Type II report from a reputable auditor, ISO 27001 with scope covering your data), (3) Find an alternative supplier. Never allow a Critical supplier to operate without any form of security assurance. Document the refusal and your decision in the risk register.

Q15: How do we manage supplier security in a merger or acquisition? A: M&A introduces massive supplier risk: (1) Immediately inventory all suppliers of the acquired company, (2) Assess them against your security standards before integration, (3) Do not grant access to your systems until assessment is complete, (4) Harmonize contracts to your clause library, (5) Plan termination of redundant suppliers with secure offboarding, (6) Integrate monitoring and access controls. M&A is a high-risk period for supplier security, treat it as a security project (A.5.20 + A.5.19).

Q16: Should we include open-source software and public libraries as "suppliers"? A: Open-source libraries are not traditional suppliers but introduce similar supply chain risks. A.5.19 focuses on contractual relationships, but the broader supply chain risk concept (A.8.25, A.8.28) includes software dependencies. Best practice: use Software Composition Analysis (SCA) tools to track open-source dependencies; monitor for vulnerabilities (CVEs); maintain an SBOM (Software Bill of Materials); have a policy for approved open-source licenses. This is increasingly required by regulations (NIS2, EO 14028 in the USA).

Q17: How do we handle a supplier breach? A: Follow the joint incident response protocol: (1) Verify the breach scope with the supplier immediately, (2) Assess if your data/systems/customers are affected, (3) Contain (revoke access if needed), (4) Investigate jointly, (5) Require root cause analysis and remediation evidence, (6) Update the supplier risk assessment, (7) Consider contract termination if negligence is proven, (8) Notify regulators if required (DPDP: 72 hours; RBI: 6 hours for payment), (9) Notify affected customers if personal data is involved, (10) Update your incident response playbook. Speed and documentation are critical.

Q18: Is there a difference between "vendor," "supplier," and "third party"? A: In practice, these terms are often used interchangeably. ISO 27001:2022 uses "supplier" consistently. "Vendor" is common in procurement and IT. "Third party" is broader and includes non-contractual relationships (e.g., industry partners, regulators). For A.5.19, focus on "suppliers", entities with whom you have a contractual relationship for products or services. The control applies regardless of the term used internally.

Q19: How do we balance security requirements with supplier relationship management? A: Security requirements should not be adversarial. Frame them as "helping us both succeed", your enterprise clients require you to have secure suppliers, so your suppliers must meet those standards. Use tiered requirements (don't overburden a small vendor), provide clear guidance (use our clause library), offer assistance (help them understand DPDP requirements), and recognize good performance (positive reinforcement in QBRs). A supplier that improves its security for your benefit often wins more business from other clients too.

Q20: Can we automate supplier risk assessment? A: Yes, and you should at scale. Automated tools can: send SSQs, collect responses, calculate risk scores, monitor security ratings, alert on certification expiry, and track remediation. However, human judgment remains essential for: architecture reviews, complex risk scenarios, negotiation of security terms, incident investigation, and relationship management. The goal is "augmented TPRM", automation handles volume and consistency; humans handle nuance and decisions.

References and Further Reading

ISO Standards

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements
2. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls, Clause 5.19
3. ISO/IEC 27003:2017, Information security management system, Guidance
4. ISO/IEC 27005:2022, Information security risk management
5. ISO/IEC 27036, Information security for supplier relationships, Multiple parts (27036-1 to 27036-4)
6. ISO/IEC 27037:2012, Guidelines for identification, collection, acquisition and preservation of digital evidence (relevant for incident investigation)

Indian Regulations and Guidelines

7. Digital Personal Data Protection Act 2023, Government of India, Ministry of Electronics and Information Technology
8. Information Technology Act 2000 (as amended in 2008), Government of India
9. CERT-In Directions 2022, Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology
10. RBI Master Direction on Digital Payment Security Controls, Reserve Bank of India, 2021
11. RBI Master Circular on Cyber Security Framework for Banks, Reserve Bank of India
12. SEBI Circular CIR/MIRSD/2/2011, Cyber Security and Cyber Resilience framework for Stock Exchanges, Depositories, and Clearing Corporations
13. SEBI Circular for Asset Management Companies, Cybersecurity and cyber resilience framework
14. IRDAI Guidelines on Information and Cyber Security for Insurers, Insurance Regulatory and Development Authority of India, 2017
15. MeitY Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
16. National Cyber Security Policy 2013, Ministry of Electronics and Information Technology

International Frameworks and Standards

17. NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations
18. NIST Cybersecurity Framework (CSF) 2.0, National Institute of Standards and Technology, 2024
19. NIST SP 800-161 Rev 1, Cybersecurity Supply Chain Risk Management Practices
20. CIS Controls v8, Center for Internet Security
21. COBIT 2019, Control Objectives for Information and Related Technologies, ISACA
22. PCI DSS v4.0, Payment Card Industry Data Security Standard
23. Shared Assessments Standardized Information Gathering (SIG) Questionnaire, Shared Assessments Working Group
24. AICPA SOC 2 Trust Services Criteria, TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy

Third-Party Risk Management Resources

25. Gartner Research: Magic Quadrant for IT Vendor Risk Management Solutions, Annual
26. Forrester Research: The Forrester Wave™: Third-Party Risk Management Platforms, Quarterly
27. BitSight Security Ratings Methodology, bitsight.com
28. SecurityScorecard Ratings Methodology, securityscorecard.com
29. UpGuard Vendor Risk Management Guide, upguard.com

Industry Reports and Statistics

30. Verizon Data Breach Investigations Report (DBIR) 2024, Verizon Business
31. IBM impact of a Data Breach Report 2024, IBM Security
32. Ponemon Institute: Data Risk in the Third-Party Ecosystem, Annual
33. CERT-In Annual Report 2023-2024, Indian Computer Emergency Response Team
34. Reserve Bank of India Annual Report, RBI cyber security and payment system sections

Supply Chain Security

35. NIST SP 800-161 Rev 1, Cybersecurity Supply Chain Risk Management Practices, National Institute of Standards and Technology
36. CISA Supply Chain Risk Management, US Cybersecurity and Infrastructure Security Agency
37. ENISA Supply Chain Security Guidance, European Union Agency for Cybersecurity