Templates and records · ISO 27001 · Clause A.5.19 a A.5.22

ISO 27001 supplier security assessment template

The record for every supplier that touches the company’s information or systems: what access it has, what the contract demands of it and how compliance is checked.

In one sentence

The supplier security assessment classifies each supplier according to the access it has to information, sets the security requirements in the contract and records how it is monitored; it answers controls 5.19 to 5.22 of ISO/IEC 27001:2022, which require supplier risks to be managed, requirements agreed, the ICT supply chain looked after and supplier services monitored.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27001 · Clause A.5.19 a A.5.22 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
Type of information: Good practice Evidence for Annex A controls 5.19 to 5.22
Who fills it in: Purchasing with the information security manager The owner of the contracted service takes part in the review
When: Before contracting and periodically Review according to criticality and whenever the service changes or the supplier has an incident
How long it is kept: Set by the organisation ISO/IEC 27001 sets no periods: it asks you to decide on the retention and disposition of documented information (7.5.3). Covering the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 27001 demands and what it leaves to your judgement

Controls 5.19 to 5.22 cover the full cycle: defining how supplier risks are managed, agreeing security requirements with each supplier, extending them to the ICT supply chain and monitoring, reviewing and evaluating their practices, including changes. Control 5.23 adds cloud services.

This is not the ISO 9001 supplier evaluation, which looks at quality, lead time and price: here the question is what harm the supplier could do to information and what guarantees it offers.

Effort is scaled to risk: a hosting provider holding customer data calls for a questionnaire, clauses and an annual review; an office supplies vendor, none of that.

Read it in context: Operation, in the ISO 27001 Academy

Structure

Fields the template should include

Supplier and service provided
Type of access: data, systems, premises
Security criticality
Requirements imposed and clauses signed (confidentiality, incident notification, subcontracting, audit)
Evidence provided: certificates, reports, questionnaire
Assessment date and result
Supplier incidents and changes to its service
Next review

Example

Example: cloud hosting provider

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Supplier	Cloud provider (fictitious) · hosting for the SaaS platform
Access	Infrastructure where customer data reside
Criticality	High
Clauses	Confidentiality, data kept in the EU, incident notification within 24 h, list of sub-processors
Evidence	Valid ISO/IEC 27001 certificate, scope reviewed
Assessment	3 March 2026 · approved
Follow-up	2-hour availability incident on 12 August: report received and reviewed
Next review	March 2027

At the audit

Mistakes auditors commonly flag

The supplier’s certificate is requested without checking that its scope covers the contracted service.
Contracts with no incident notification clause.
Nobody reviews suppliers once the contract is signed.
Cloud services contracted by a department without going through security.

In Kimobox

How this record is kept in Kimobox

1Each supplier is registered with its security clauses from the supplier portal.
2Supplier evidence is kept on its record, with an expiry date and an alert.
3Ongoing supplier evaluation sits alongside its documentation: if a certificate expires, the supplier loses its approved status before a purchase order can be issued.

Frequently asked questions

What people ask us before getting started

Is it enough for the supplier to be ISO 27001 certified?

It helps a great deal, but you need to read the certificate’s scope: if it does not include the service being contracted, it does not cover it. And the certificate is no substitute for the contract clauses.

Can I use the same record as for ISO 9001?

The same supplier record, yes; the same assessment, no. It is worth adding a security section to the general record with its own criteria and its own frequency.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022