Addressing information security within supplier agreements

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.OC-03 GV.OC-04 GV.OV-03 GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 GV.SC-10 ID.RA-09 ID.RA-10 topicsVendor Risk Mgmt frameworks6 4 2

Official text · not licensableTitle: Addressing information security within supplier agreements. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.20 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 9 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Loosely related Only shares CSF GV.OC-04: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 1 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt 1 loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF GV.SC-01: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 30 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-01, GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OC-04, GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-03, GV.SC-01, GV.SC-05, GV.SC-07: related, not a mapping …and 22 more in the downloads
CMMC	RA.L2-3.11.1 RA.L2-3.11.2 RA.L2-3.11.3 CA.L2-3.12.1	Risk Assessments; Vulnerability Scan…	Loosely related	No mapping. Only shares CSF GV.OV-03, GV.SC-03, GV.SC-05, GV.SC-06…: related, not a mapping
800-53	SA-4 SA-9 SR-6 SR-2 SR-3 SR-5	Acquisition Process; External System Services…	Crosswalk	Same topic: Vendor Risk Mgmt NIST SP 800-53 → ISO 27001 mapping 25 loosely related (not mappings) PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-04, GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OV-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping PM-28 Risk Framing Loosely related Only shares CSF GV.OC-03, GV.SC-09: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.OC-04, GV.SC-07: related, not a mapping SR-10 Inspection of Systems or Components Loosely related Only shares CSF GV.SC-05, ID.RA-09: related, not a mapping …and 17 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 38 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-09…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.OC-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping …and 30 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF GV.OC-04: related, not a mapping
NIS2	5.1 5.2 6.1 2.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt ENISA NIS2 → ISO 27001 mapping 4 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03, ID.RA-10: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.OC-04: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 11 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09…: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09…: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09…: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(1) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 3 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.