Supplier Register Template (ISO/IEC 27001 A.5.19 to A.5.22)

Supplier inventory: criticality tiers, data and access, services, contract dates, security terms, certifications, last assessment, review cadence, metrics

ISMS 与 ISO/IEC 27001标准ISO/IEC 27001:2022 A.5.19 to A.5.23 (cited only); ISO/IEC 27036-2:2022supplier register更新于 2026年11月1日

在编辑器中打开下载 .md

使用方法: Use it as the master list of suppliers that touch your information, systems or premises. Fill the tiering criteria first, then populate it from accounts payable and identity provider app grants. The main pitfall is listing contracts without data and access, because the tier depends on what a supplier can touch, not on what it costs.

预览

Supplier Register: [Organization name]

The single inventory of suppliers that matter to information security: what each one provides, what information and systems it touches, its criticality tier, contract dates, security terms, certifications held, last assessment and next review. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.19 to A.5.23 (supplier relationships, agreements, ICT supply chain, monitoring and cloud services). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-066
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@vendor-manager or @isms-manager]
Approvers/reviewers	[@isms-manager], [@head-of-procurement], [@dpo]
Last updated	YYYY-MM-DD
Classification	[Confidential]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (A.5.19 to A.5.23); ISO/IEC 27036-2:2022
Next scheduled review	YYYY-MM-DD (full review every [3] months; entries updated on any change)
Source systems	[Accounts payable, procurement tool, identity provider app catalogue, contract repository]

Approvals

Role	Name	Decision	Date
Register owner	[@vendor-manager]	[Prepared]	YYYY-MM-DD
ISMS manager	[@isms-manager]	[Reviewed]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
0.1	YYYY-MM-DD	[@author]	First population from accounts payable and identity provider
1.0	YYYY-MM-DD	[@author]	Tiers assigned and approved
[x.y]	YYYY-MM-DD	[@author]	[Quarterly review summary]

1. Purpose and scope
2. Field definitions
3. Criticality tiering
4. Register
5. Review cadence and triggers
6. Summary metrics
7. Size tiers
8. Records and evidence
9. References
Standard and licence note

1. Purpose and scope

The register lists every supplier that accesses, processes, stores or transmits [Organization name] information, connects to its systems, enters its secure areas, or delivers ICT products and services the organization depends on. It is the source for the supplier assessment schedule (DOC-ISMS-067), the choice of contract terms (DOC-ISMS-068), supplier monitoring and the supplier section of management review (DOC-ISMS-085).

Cloud services may be kept in the cloud service register of DOC-ISMS-044 section 12; if so, give each cloud entry a supplier ID here and cross reference the CLD ID, so that no supplier appears in only one list.

2. Field definitions

Field	Meaning
ID	SUP-NNN, never reused
Supplier and service	Generic description of the supplier and what it provides
Category	Cloud IaaS or PaaS, SaaS, managed service, professional service, staffing, ICT product, facilities
Business owner	Person accountable for the relationship and its budget
Tier	Critical, High, Medium or Low, from section 3
Data and access	Highest data classification handled, personal data role, system or premises access
Locations	Countries or cloud regions where data is stored or accessed
Contract	Reference, start date, renewal or end date, notice period
Security terms	Security schedule signed, deviation IDs, DPA in place
Certifications	Certificates or assurance reports held, scope match and expiry
Last assessment	Assessment reference, date and result
Next review	Due date set by the tier
Exit approach	Exit plan reference or data export method
Status	Proposed, Active, Under review, Exiting, Retired

3. Criticality tiering

Tier	Criteria (Example)	Cloud policy tier	Contract terms	Reassessment interval
Critical	Supports a critical business process or customer service; holds Confidential data at scale; privileged access to production or security tooling	Tier 1	Full security schedule, exit plan	Every 12 months
High	Holds Confidential or personal data, or has privileged or broad access to systems	Tier 2	Full security schedule	Every 12 months
Medium	Internal data or limited personal data, user-level access	Tier 2	Short-form schedule	Every 24 months
Low	No data beyond contact details, no system access	Tier 3	Standard terms	At renewal, at most every 36 months

Where a cloud service also has a tier under DOC-ISMS-044 section 4 and the two give different reassessment intervals (for example a High supplier that is a Tier 2 cloud service, reassessed every two years under the cloud policy), apply the shorter interval. Assessment references use the DOC-ISMS-067 format SSA-YYYY-NNN, with NNN taken from the supplier ID.

4. Register

4.1 Service, data and contract

ID	Supplier and service	Category	Business owner	Tier	Data and access	Locations	Contract (renewal, notice)	Security terms
SUP-001 (Example)	Public cloud provider, production platform (CLD-001)	Cloud IaaS and PaaS	CTO	Critical	Confidential, customer personal data as processor; hosts production	Primary and DR region	Enterprise agreement, renews 2027-06-30, 90 days	Standard terms gap review, DEV-001; DPA
SUP-002 (Example)	Collaboration suite: mail, files, chat (CLD-002)	SaaS	COO	Critical	Confidential, staff and customer contact data	Tenant region	Online terms, renews 2027-03-31, 30 days	Standard terms gap review; DPA
SUP-003 (Example)	CRM (CLD-003)	SaaS	Head of Sales	High	Confidential, customer contact data as controller	Single region	Subscription, renews 2027-01-31, 60 days	Security schedule signed; DPA
SUP-004 (Example)	Diagramming tool (CLD-004)	SaaS	Head of Product	Low	Internal, user accounts only	Not applicable	Monthly plan, 30 days	Standard terms
SUP-005 (Example)	Identity provider	SaaS	Head of Engineering Operations	Critical	Credentials and access for all staff	Two regions	Subscription, renews 2027-07-01, 60 days	Security schedule signed; DPA
SUP-006 (Example)	Payroll and HR platform	SaaS	Head of People	High	Confidential employee personal data	Single country	Subscription, renews 2027-03-20, 90 days	Standard terms gap review, DEV-002; DPA
SUP-007 (Example)	Contractor agency supplying the 8 contractors	Staffing	Head of Engineering Operations	High	Contractors hold user and some admin access	Remote, 2 countries	Frame agreement, renews 2027-04-15, 30 days	Security schedule signed; NDAs per person
SUP-008 (Example)	Penetration testing firm	Professional service	Security lead	High	Temporary privileged test access, findings data	Remote	Statement of work per test, current to 2026-12-31	Security schedule signed
SUP-009 (Example)	Office cleaning	Facilities	Office manager	Low	Out-of-hours office access, no system access	Office	Annual contract, renews 2026-11-30, 30 days	Standard terms with confidentiality clause
SUP-010 (Example)	Device management and endpoint protection	SaaS	IT lead	High	Admin control of all laptops	Single region	Subscription, renews 2027-01-25, 60 days	Security schedule signed
SUP-011 (Example)	Customer support ticketing	SaaS	Head of Customer Success	Medium	Internal, limited customer contact data	Single region	Subscription, renews 2027-10-12, 30 days	Short-form schedule; DPA

4.2 Assurance and review

ID	Certifications held (scope, expiry)	Last assessment (ref, date, result)	Next review	Exit approach	Status
SUP-001 (Example)	ISO/IEC 27001 covering the service, expires 2027-06-30; independent assurance report	SSA-2026-001, 2026-09-15, Acceptable	2027-09-15	Cloud exit plan DOC-ISMS-076 (production platform)	Active
SUP-002 (Example)	ISO/IEC 27001, expires 2027-03-31	SSA-2026-002, 2026-08-02, Acceptable	2027-08-02	Cloud exit plan DOC-ISMS-076 (collaboration suite)	Active
SUP-003 (Example)	Independent assurance report, period ends 2026-12-31	SSA-2026-003, 2026-05-10, Acceptable with conditions	2027-05-10	CSV and API export, tested 2026-05-10	Active
SUP-004 (Example)	None required	Registration and contract check, 2026-02-01, Acceptable	At renewal, at the latest 2029-02-01	Export to files	Active
SUP-005 (Example)	ISO/IEC 27001, expires 2027-09-30	SSA-2026-005, 2026-07-01, Acceptable	2027-07-01	Directory export, documented	Active
SUP-006 (Example)	ISO/IEC 27001, expires 2027-02-28	SSA-2026-006, 2026-03-20, Acceptable with conditions	2027-03-20	Payroll history export	Active
SUP-007 (Example)	None; agency controls checked by assessment	SSA-2026-007, 2026-04-15, Acceptable	2027-04-15	Offboarding checklist DOC-ISMS-053	Active
SUP-008 (Example)	Tester certifications checked per engagement	SSA-2026-008, 2026-06-10, Acceptable	2027-06-10	Data return and deletion confirmation per test	Active
SUP-009 (Example)	None required	Registration and contract check, 2025-11-05, Acceptable	At renewal on 2026-11-30	Badge return	Active
SUP-010 (Example)	ISO/IEC 27001, expires 2026-12-15	SSA-2025-010, 2025-10-20, Acceptable	2026-10-20 (overdue)	Device re-enrolment plan	Under review
SUP-011 (Example)	Independent assurance report	SSA-2025-011, 2025-10-12, Acceptable	2027-10-12	Ticket export	Active

5. Review cadence and triggers

Activity	Frequency (Example)	Owner	Output
Register completeness check against accounts payable and identity provider app grants	Every 3 months	Register owner	New rows, retired rows
Reassessment per tier (section 3)	12, 24 or up to 36 months	Vendor manager with business owner	Updated assessment (DOC-ISMS-067)
Certificate and assurance report expiry check	Monthly	Vendor manager	Request for renewed evidence
Obligation tracking for signed schedules	Monthly	Vendor manager	DOC-ISMS-068 section 9 tracker
Supplier summary to management review	Each management review	ISMS manager	Metrics in section 6

Review early when: the supplier has a security incident; it changes ownership, locations or sub-contractors; the service scope or data changes; a certificate lapses or narrows; a regulator or customer raises a concern; or the contract is due for renewal.

6. Summary metrics

Metric	Value (Example)
Suppliers in register	11
By tier	Critical 3, High 5, Medium 1, Low 2
Critical and High suppliers with a signed schedule or a completed gap review of standard terms	8 of 8
Processors of personal data with a DPA	6 of 6 (SUP-001, SUP-002, SUP-003, SUP-005, SUP-006, SUP-011)
Reviews overdue	1 (SUP-010)
Certificates or assurance report periods ending in the next 90 days	2 (SUP-010 certificate on 2026-12-15, SUP-003 report period on 2026-12-31)
Fixed-term contracts renewing or ending in the next 90 days	3 (SUP-009 on 2026-11-30, SUP-008 on 2026-12-31, SUP-010 on 2027-01-25)

Note: the agency (SUP-007) is not a processor; its contractors work under the organization's control and sign individual confidentiality agreements (DOC-ISMS-051). The monthly plan of SUP-004 is not counted as a renewal. Count DPAs only where a processor relationship exists.

7. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites)
Typical size (Example)	About 30 suppliers in scope, most of them SaaS	About 120 suppliers, including colocation and clinical integration partners	Over 1,000 suppliers, filtered to several hundred with information access, including OT vendors
Tool	Spreadsheet kept by the 0.5 FTE ISMS manager	GRC or procurement tool linked to the contract repository	Third-party risk platform fed by procurement, per site and country
Owner	ISMS manager	Vendor manager in procurement, with the security team	Third-party risk team in the CISO office, site coordinators
Review	Quarterly completeness check	Quarterly, with monthly expiry reports	Continuous monitoring for Critical suppliers, quarterly site reviews

8. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
Register with version history	Suppliers are known, tiered and owned	Register owner	[Register location]	Current plus 3 years of history
Quarterly completeness checks	The register stays complete	Register owner	[Review log]	3 years
Supplier assessments	Due diligence per tier	Vendor manager	DOC-ISMS-067 records	Life of contract plus 3 years
Contracts, schedules and deviations	Security terms agreed	Legal counsel	DOC-ISMS-068 records	Life of contract plus 6 years
Exit records	Data returned and deleted	Technical owner	[Supplier file]	6 years after exit

Map these records to A.5.19 to A.5.23 in isms/control-evidence-matrix.

9. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html	Current	A.5.19 to A.5.23
ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html	Current	Control guidance
ISO/IEC 27036-2:2022, https://www.iso.org/standard/82060.html	Current	Supplier relationship requirements
Related templates		`compliance/supplier-security-assessment`, `isms/supplier-security-agreement-27036`, `isms/cloud-services-security-policy`, `isms/cloud-exit-plan`, `compliance/dora-ict-third-party-register`, `isms/control-evidence-matrix`

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (Annex A controls A.5.19 to A.5.23), ISO/IEC 27002:2022 and ISO/IEC 27036-2:2022. The fields, tiers and examples are original text, and no text from ISO/IEC standards is reproduced. Obtain the official standards from ISO, IEC or your national standards body, and check the current edition before use.

Template licence: MIT.