{"id":13584,"date":"2021-12-30T00:53:35","date_gmt":"2021-12-29T21:53:35","guid":{"rendered":"https:\/\/www.arab-academy.com\/?p=13584"},"modified":"2024-10-23T00:14:49","modified_gmt":"2024-10-22T21:14:49","slug":"supplier-relationships-iso-27001","status":"publish","type":"post","link":"https:\/\/www.arab-academy.com\/en\/supplier-relationships-iso-27001\/","title":{"rendered":"Clause A.15 Supplier relationships of the standard ISO\/IEC 27001:2013"},"content":{"rendered":"

[vc_row][vc_column width=”3\/4″][vc_custom_heading text=”Clause A.15 Supplier relationships ISO 27001 certification” font_container=”tag:h1|text_align:left” use_theme_fonts=”yes” css=”.vc_custom_1638529958731{margin-bottom: 32px !important;}”][vc_single_image image=”13588″ img_size=”large”][vc_column_text]<\/p>\n

Introduction about Supplier relationships
\n<\/b><\/h2>\n
\n

To implement an effective processes for information security, the organization need to establish a system to ensure protection of the organization\u2019s assets that are accessible by suppliers (third party), and maintain an agreed level of information security and service delivery in line with supplier agreements to cover the Clause A.15 Supplier relationships of the standard ISO\/IEC 27001:2013<\/a><\/p>\n<\/div>\n

Information security in supplier relationships<\/strong><\/h3>\n

The objective here is to ensure protection of the organization\u2019s assets that are accessible by suppliers.<\/p>\n

Information security policy<\/a> for supplier relationships<\/h3>\n

The organization shall ensure that the information security requirements for mitigating the risks associated with supplier\u2019s access to the organization\u2019s assets are agreed with the supplier and documented.<\/p>\n

Addressing security within supplier agreements<\/h3>\n

All relevant information security requirements are established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for, the organization\u2019s information.<\/p>\n

The organization shall ensure that the security controls, service definitions and delivery levels included in the third party service delivery agreement are implemented, operated, and maintained by the third party.<\/p>\n

Information and communication technology supply chain<\/h3>\n

Our organization\u2019s agreements with suppliers include requirements to address the information security risks associated with information and communications technology services and product supply chain.<\/p>\n

Supplier service delivery management<\/strong><\/h2>\n

The objective here is to maintain an agreed level of information security and service delivery in line with supplier agreements.<\/p>\n

Monitoring and review of supplier services<\/h2>\n

To fully comply with ISO 27001 certification<\/a> requirements, the organization would regularly monitor, review and audit supplier service delivery.<\/p>\n

Service delivery by a third party must include the agreed security arrangements, service definitions, and aspects of service management. In case of outsourcing arrangements, the organization would plan the necessary transitions (of information, information processing facilities, and anything else that needs to be moved), and would ensure that security is maintained throughout the transition period.<\/p>\n

The services, reports and records provided by the third party are regularly monitored and reviewed, and audits (internal ISMS audits) are carried out regularly.<\/p>\n

Monitoring and review of third party services is to ensure that the information security terms and conditions of the agreements are being adhered to, and that information security incidents and problems are managed properly.<\/p>\n

This involves a service management relationship and process between the organization and the third party to:<\/p>\n

    \n
  1. monitor service performance levels to check adherence to the agreements<\/li>\n
  2. review service reports produced by the third party and arrange regular progress meetings as required by the agreements<\/li>\n
  3. provide information about information security incidents and review of this information by the third party and the organization as required by the agreements and any supporting guidelines and procedures<\/li>\n
  4. review third party audit trails and records of security events, operational problems, failures, tracing of faults and disruptions related to the service delivered, and<\/li>\n
  5. resolve and manage any identified problems.<\/li>\n<\/ol>\n

    The responsibility for managing the relationship with a third party could be assigned to the HOD (Purchase) as example. The HOD (Technical) is consulted by the HOD (Purchase) for all technical matters needing clarification, you should consider that you have your own choice to select the convenient candidate as per available and suitable to your organization and its structure.<\/p>\n

    In addition, the organization would ensure that the third party assigns responsibilities for checking compliance and enforcing the requirements of the agreements. Sufficient technical skills and resources are made available to monitor that information security requirements of the agreement are being met.<\/p>\n

    Appropriate action is taken when deficiencies in the service delivery are observed.<\/p>\n

    The organization maintains sufficient overall control and visibility into all security aspects for sensitive or critical information or information processing facilities accessed, processed or managed by a third party. The organization ensures that they retain visibility into security activities such as change management, identification of vulnerabilities, and information security incident reporting\/response through a clearly defined reporting process, format and structure.<\/p>\n

    Managing changes to supplier services<\/h2>\n

    Changes to the provision of services by suppliers, including maintaining and improving existing information security policies, procedures and controls, should be managed, taking account of the criticality of business information, systems and processes involved and re-assessment of risks.<\/p>\n

    The ISO 27001 certified organization shall have process of managing changes to a third party service takes account of:<\/p>\n

      \n
    1. changes made by the organization to implement:\n
        \n
      • enhancements to the current services offered<\/li>\n
      • development of any new applications and systems<\/li>\n
      • modifications or updates of the organization\u2019s policies and procedures, and<\/li>\n
      • new controls to resolve information security incidents and to improve security<\/li>\n<\/ul>\n<\/li>\n
      • changes in third party services to implement:\n
          \n
        • changes and enhancement to networks<\/li>\n
        • use of new technologies<\/li>\n
        • adoption of new products or newer versions\/releases<\/li>\n
        • new development tools and environments<\/li>\n
        • changes to physical location of service facilities, and<\/li>\n
        • change of vendors.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n

          [\/vc_column_text][vc_cta h2=”Reqest a Quote for training \/ consultation \/ certification” h2_font_container=”tag:h2|text_align:left” h2_use_theme_fonts=”yes” h4=”Complete package for ISO 27001 training \/ consultation \/ certification” h4_font_container=”tag:h4|text_align:left” h4_use_theme_fonts=”yes” shape=”round” color=”white” add_button=”bottom” btn_title=”Contact us \/ Request a Quote” btn_color=”blue” btn_align=”right” btn_i_align=”right” btn_i_icon_fontawesome=”fas fa-phone-alt” add_icon=”bottom” use_custom_fonts_h2=”true” use_custom_fonts_h4=”true” btn_add_icon=”true” i_on_border=”true” css=”.vc_custom_1638631863588{background-color: #dd9933 !important;}” btn_link=”url:https%3A%2F%2Fwww.arab-academy.com%2Fen%2Frequest-quotation%2F|title:Request%20a%20quotation”]<\/p>\n

          Our information security experts will assist your organization to obtain ISO 27001 certification according to ISO 27001 standard, our experts will give a full guidance to implement an effective information security management system and analysis your business risks, request a quote now.<\/p>\n

          [\/vc_cta][\/vc_column][vc_column width=”1\/4″][stm_sidebar sidebar=”11735″][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

          [vc_row][vc_column width=”3\/4″][vc_custom_heading text=”Clause A.15 Supplier relationships ISO 27001 certification” font_container=”tag:h1|text_align:left” use_theme_fonts=”yes” css=”.vc_custom_1638529958731{margin-bottom: 32px !important;}”][vc_single_image image=”13588″ img_size=”large”][vc_column_text] Introduction about Supplier relationships To implement an effective processes for information security, the organization need to establish a system to ensure protection of the organization\u2019s assets that are accessible by suppliers (third party), and maintain an agreed level of […]<\/p>\n","protected":false},"author":1,"featured_media":13588,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[301],"tags":[],"class_list":["post-13584","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-iso-27001-certification"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/posts\/13584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/comments?post=13584"}],"version-history":[{"count":0,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/posts\/13584\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/media\/13588"}],"wp:attachment":[{"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/media?parent=13584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/categories?post=13584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.arab-academy.com\/en\/wp-json\/wp\/v2\/tags?post=13584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}