ISO 27001 Third-Party Risk Management Requirements

If your organization is seeking ISO 27001 certification, and you outsource physical hosting to a third-party vendor, you may be wondering if and how to include them in the scope of your Information Security Management System (ISMS). 

This confusion around how to treat a critical third-party service provider commonly occurs when an organization is in the early stages of scoping their ISMS. Some organizations attempt to scope the third-party provider within their ISMS, which leads to difficulties when trying to treat the risks that might be applicable to a third party. Others take a more tolerant approach and “transfer” all applicable outsourcing risk to the third-party service provider, without treating the risk at all. The correct approach is actually somewhere in the middle, and in 2022, new ISO 27001 Annex A controls were added to provide additional clarity. 

Here and throughout, we will refer to vendors, suppliers, and service providers interchangeably.  

The Importance of Third-Party Risk Management  

It’s common for organizations to outsource external suppliers, service providers, and vendors to handle critical business functions including IT infrastructure, cloud services, and data processing. However, these third-party partnerships come with increased risks that must be regularly and strategically monitored, assessed, and managed. 

Effective third-party risk management is essential for maintaining a secure and resilient ISMS, as vendors can introduce significant security and compliance risks. ISO 27001:2022 requires organizations to include key suppliers in the scope of the ISMS (Clause 4) and the risk assessment process (Clauses 6 & 8) to ensure their security controls align with business and regulatory requirements (Annex A). Further, Annex A controls have been designed to provide a structured approach to managing supplier risks, enforcing security expectations, and ensuring continuous monitoring. 

An organization should include third-party suppliers in their ISMS risk assessment process as they can introduce security vulnerabilities, compliance risks, and operational dependencies that impact the organization’s overall security posture. Clause 6.1 requires organizations to identify and assess risks associated with external parties, including suppliers, to ensure appropriate controls are implemented. By including third-party suppliers in the risk assessment process, organizations can identify, evaluate, and mitigate potential security threats arising from external dependencies. 

ISO 27001 Third-Party Risk Management Requirements Explained 

When defining the scope of the ISMS (as part of Clause 4.3), it is essential to account for high-risk key vendors (e.g., AWS, GCP, etc.), as their services directly impact the organization’s security posture. Their inclusion in the scope of the ISMS ensures that third-party supplier relationships are evaluated under Clause 6.1, managed effectively under Clause 8, and aligned with Annex A controls (e.g., A.5.19, A.5.20, etc.). 

The following are some of the specific controls in which ISO 27001:2022 emphasizes the importance of managing third-party risks:  

Annex A Control A.5.19: Information Security Supplier Relationships  

Ensures that organizations define and implement security requirements for suppliers based on the risks that they introduce. This includes assessing suppliers’ security controls, incorporating security clauses in contracts, and continuously monitoring compliance to protect the organization’s information and systems. 

Annex A Control A.5.20: Information security within supplier agreements  

Ensures that information security requirements are explicitly defined and enforced within supplier agreements. This includes contractual obligations for data protection, security controls, incident reporting, and compliance monitoring to safeguard organizational information throughout the supplier relationship. 

Annex A Control A.5.21: Third-party information security policies 

Ensures that organizations manage security risks across the entire ICT supply chain. This includes assessing and monitoring suppliers and their subcontractors to ensure they meet security requirements, maintain data integrity, and mitigate risks related to third-party dependencies. 

Annex A Control A.5.23: Information security for use of cloud services 

Ensures that organizations assess and implement security measures for cloud services based on risk, business needs, and compliance requirements. This includes defining security responsibilities between the organization and the cloud provider, implementing controls for data protection, and continuously monitoring cloud service security to mitigate risks. 

Annex A Control A.8.30: Outsourced development 

Ensures that organizations manage security risks associated with externally developed software or systems. This includes defining security requirements in contracts, assessing the security practices of third-party developers, and ensuring secure coding, testing, and delivery to protect against vulnerabilities and unauthorized access. 

These updated controls require your organization to establish security requirements for third-party services in contracts as well as continuously monitor third-party compliance. Your organization must also ensure risk treatment is documented and aligned with your ISMS risk management process.  

Organizations must have a process in place to evaluate, monitor, and document third-party risks to ensure they meet their security expectations. Evidence of that monitoring should be available as a record of the ISMS. 

Elements of Managing Third-Party Service Providers in ISO 27001 

To ensure you meet these requirements under ISO 27001, it’s important to adjust your third-party risk management strategy. Elements of effectively managing risks with third-party service providers include: 

Due diligence in vendor selection 

Organizations must conduct a thorough evaluation of potential vendors before engagement, assessing their security posture, compliance with industry standards (e.g., ISO 27001 certification, SOC 2, etc.), history of data protection practices, and more. This helps identify third-party vendors that align with the organization’s security requirements. 

Thorough vendor risk assessment processes 

A risk assessment should be performed to evaluate the potential security threats a vendor may introduce, not only considering likelihood and impact, but also factors such as data access, regulatory compliance, and external dependencies. This risk assessment process helps determine the level of risk mitigation required and decisions on necessary controls (Annex A). 

Contractual agreements 

Security expectations and responsibilities must be defined in legally binding contracts, including provisions for data protection, incident reporting, compliance requirements, and audit rights. These agreements help ensure vendors comply with the organization's security policies and regulatory obligations. 

Regular ongoing audits and documentation 

Periodic security audits are essential to verify that vendors continue to meet contractual security requirements and agreements. Ongoing monitoring enables organizations to enforce compliance and address risks with vendor relationships. 

Take the Next Steps Toward an ISO 27001 Certification 

If you’re interested in learning more about Schellman’s Certification Body accreditations and our process in how we can streamline your journey to ISO 27001 compliance, contact us today.  

In the meantime, learn more about ISO 27001 certification and third-party risk management here:  

• ISO 27001 Overview: Your Guide to Compliance 
• ISO/IEC 27001:2022 Has Been Published: What Now? 
• How to Create Efficiencies in Your ISO 27001 Certification 
• How to Improve Your TPRM with External Assistance and Validation