ISO 27001 A.5.21: Managing information security in the ICT supply chain

Start by mapping the ICT supply chain for your critical systems and services. Identify key suppliers, their sub-suppliers where possible, and your software dependencies including open-source components. You cannot protect what you do not know about. Define supply chain security requirements for different categories. For hardware: use trusted procurement sources, require tamper-evident packaging, verify integrity on receipt, and configure securely before deployment. For software: evaluate the vendor's development security practices, request SBOMs (software bills of materials), verify code signing, and ensure secure delivery. For services: assess the provider's own supply chain management. Put supply chain security requirements into your supplier agreements. Require suppliers to maintain their own supply chain security programme, notify you of significant supply chain incidents, give you visibility into critical sub-suppliers, follow secure development practices, and provide SBOMs where applicable. Implement technical controls for verification. Check software integrity using digital signatures and checksums before deploying anything. Run vulnerability scanning on software components and dependencies. Monitor supply chain compromise advisories from CERTs and vendor security teams. Use application whitelisting to block unauthorised software. Set up ongoing monitoring. Subscribe to vulnerability feeds for your technology stack. Watch for security advisories from ICT suppliers. Join information-sharing communities that report supply chain incidents. Assess critical suppliers' security practices periodically. Have a response plan ready for supply chain compromise scenarios.