ISO 27001 control 5.21 applies to software dependencies by asking you to assess and treat the risks of ICT products and services you take from third parties, including the effect of a supplier incident on your own data. Keep a supplier and component inventory, a risk assessment, and treatment decisions.
What the control says
Control 5.21 requires organizations to assess and treat risks from third party ICT products and services. It also asks you to understand how a security incident at one supplier could affect other suppliers in the chain and your own data. A supplier security policy is recommended for smaller companies, and a procedure for larger ones.
Where software dependencies fit
Open source libraries, SDKs, hosted APIs and build tools are ICT products and services. A weakness in one of them can reach your product. So the inventory should list them, not only the vendors you pay.
| Supplier type | What to record |
|---|---|
| Cloud and hosting | Service, data held, incident contact |
| Hosted APIs and SaaS | Data shared, owner, review date |
| Libraries and packages | Name, version, where used, known issues |
| Build and CI tools | Access they hold, who maintains them |
Reuse your risk process
The guidance says you can reuse existing risk management with small changes. Add three questions per supplier:
- What do we use it for, and what data does it touch?
- What happens to us if it is compromised or disappears?
- What do we do about it: accept, reduce, replace or monitor?
Evidence to keep
Auditors typically look for proof that technology risks from third party IT services are managed.
- The supplier policy or procedure
- An inventory of suppliers and components
- Risk assessments with treatment decisions
- Review dates, and updates after a supplier incident
- Monitoring records for critical services
Try it yourself
Open the demo and see how a dependency inventory is built from a project. Look at how direct and indirect packages show up, because that list is your component inventory.
Click through it at your own pace, or open it full screen.
Quick check
Do open source libraries count as suppliers?
They are third party ICT products, so their risk belongs in the assessment even though you do not pay for them.
Is an SBOM required by control 5.21?
No. The control does not name one. An SBOM is one practical way to keep the component inventory.
Where tooling helps
Safeguard offers SBOM and dependency scanning, reachability analysis and compliance and evidence automation, which help keep a component inventory with dated records. Treatment decisions are yours. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
