ISO 27001 A.5.22: Monitoring, review and change management of supplier services

Set up a supplier monitoring programme scaled to risk. Define what you monitor, how often, and who is responsible. High-risk suppliers get quarterly reviews; lower-risk ones might only need annual checks. Regular monitoring should include: reviewing SOC 2 Type II reports or ISO 27001 surveillance audit results annually, tracking SLA performance, evaluating supplier security incidents, checking their vulnerability management and patching practices, assessing the impact of any changes they make, and periodically sending updated security questionnaires. Establish a supplier change management process. Require suppliers to notify you of significant changes - infrastructure moves, new sub-processors, changes to data processing locations, security control modifications, key personnel departures. Evaluate each change for security impact and approve or push back before implementation. Hold regular review meetings with critical suppliers - quarterly works well. Include security on the agenda alongside performance. Review security metrics, incidents, audit findings, and upcoming changes. Document outcomes and track action items to completion. Maintain a centralised view of supplier risk. Use a third-party risk management platform or a well-maintained register to track assessments, compliance status, incident history, and review schedules. Report the overall supplier risk picture to management regularly. Have a defined escalation path for suppliers who fall short, up to and including termination if necessary.