Control 5.19 requires you to manage risks related to suppliers' products and services, so you can plan how to protect information shared with them. Reuse your existing risk process with small changes, keep a supplier list with assessments, and be ready to show that supplier risks are managed.
What the control expects
A process to assess, evaluate and treat supplier related risks. The guidance says companies can reuse their existing risk management process with minor adjustments, so you do not need a second system.
Tools can be modest. Spreadsheets work, or dedicated risk management software if you have it.
A supplier process in five steps
- List your suppliers, including software vendors, cloud providers, contractors and open source components you depend on.
- Note what information each can reach and how critical each is to you.
- Assess the risk in proportion to that access.
- Decide treatment: accept, add a contract term, add a technical control, or switch.
- Review on a schedule and when something changes.
The guidance does not describe how to classify suppliers, so choose tiers that fit your own business and write the logic down.
Agreements are a separate control
Security terms in contracts are covered by a neighbouring control, 5.20, on addressing security in supplier agreements. Treat the two together in practice but record them separately in your Statement of Applicability.
People
Make employees aware of why supplier risk matters. Train the people who assess and treat supplier risks, which often means procurement as well as security.
Documents
Recommended, not mandatory: a supplier security policy for smaller and mid sized companies, and a procedure for managing supplier security risks for larger ones.
What auditors check
They look for evidence that information risks related to third party products and services are managed. Missing evidence is treated as a nonconformity. Bring:
- The supplier list with tiers and owners.
- Completed assessments for the most important suppliers.
- Records of decisions and treatments.
- The review schedule and the last review.
A software team angle
Your suppliers include the packages in your product. A software bill of materials gives you a list of those dependencies to feed the supplier list, though this control is about managing the risk, not just listing it. Safeguard SBOM and dependency scanning can produce that inventory.
Start with your top ten
If the supplier list feels huge, begin with the ten suppliers whose failure or breach would hurt most. Do a proper assessment for those, a lighter review for the next tier, and a one line note for the rest. Auditors accept a proportionate approach that you can explain, and a partial but honest list beats a complete one with no assessments behind it.
Quick check
Do open source libraries count as suppliers?
They are third party components you rely on, so many teams include them in supplier risk, usually through dependency management rather than contracts.
Is a questionnaire required for every supplier?
No. Scale the assessment to the access and criticality. A low risk tool may need only a short review.
Sources
Last reviewed: 19 October 2026.
