ISO 27001 A.5.20: Addressing information security within supplier agreements

Create a library of standard security clauses that can be mixed and matched for different supplier types. Get legal counsel involved early to make sure they are enforceable in your jurisdiction. Core security requirements for agreements: what information is being accessed or processed and its classification, specific controls the supplier must have in place (encryption, access control, monitoring), compliance with applicable laws and regulations (GDPR and industry-specific rules), incident notification obligations with clear timeframes (typically 24-72 hours), right to audit or receive audit reports, restrictions on sub-processing and requirements for the supplier's own supply chain, data residency and cross-border transfer rules where relevant. Also cover: business continuity and disaster recovery expectations, data backup and retention, secure disposal of data when the contract ends, personnel security requirements for supplier staff who have access, change management notifications for anything affecting security, intellectual property protection, and liability for breaches. For cloud providers specifically, add clauses on: multi-tenancy and data segregation, encryption at rest and in transit, identity and access management, logging and monitoring capabilities, data portability and exit strategy, and SLAs for availability and security metrics. Make sure the security team reviews every agreement that involves access to or processing of organisational information before it gets signed. Keep a register of active agreements and their security provisions. Review existing agreements periodically - relationships evolve and contracts should keep pace.