A.5.20 Organizational
Addressing information security within supplier agreements
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (15)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PS-7mostlycovers — A.5.20's focus on embedding and maintaining information security requirements (including personnel security aspects) within supplier agreements accounts for the bulk of PS-7's external-provider personnel-security obligations, but leaves a residual slice of general (non-information-security) personnel screening, roles documentation, and notification mechanics that sit outside A.5.20's explicit scope.
- SR-3mostlyaligns with — The ISO control operationalizes the NIST requirement to impose and verify supply-chain security controls through contractual terms and ongoing assurance mechanisms.
- AU-6partialaligns with — The agreements mandate periodic reporting on control effectiveness and grant the organization rights to audit supplier processes and records.
- CA-6partialaligns with — Third-party attestations and independent reports on control effectiveness provide evidence that supports ongoing authorization decisions for supplier services.
- IR-4partialaligns with — Incident-management, notification, and collaborative remediation obligations are required elements of the supplier agreements.
- PS-7partialaligns with — Personnel screening, acceptable-use rules, and authorization procedures for supplier staff are explicitly addressed in the supplier-agreement clauses.
- SA-9nonegoverns — Both controls require formal agreements that define security obligations, access rules, monitoring rights, and incident responsibilities when an organization relies on external providers.
- SR-3governs — A.5.20's policy-level mandate to maintain agreed security levels in supplier agreements directly requires establishing processes to identify/address supply-chain weaknesses (the core of SR-3), operating as domain-mandate governance over the technical control without naming it verbatim.
Aligned NIST CSF 2.0 outcomes (23)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- GV.SC-05fullcovers — Embedding security obligations, access rules, incident procedures, and audit rights directly into supplier contracts satisfies the CSF requirement to establish and integrate cybersecurity requirements into supplier agreements.
- GV.SC-02mostlyaligns with — Defining roles, contacts, screening, and responsibilities for both the organization and the supplier in the agreement aligns with establishing and coordinating cybersecurity roles across the supply chain.
- GV.SC-07mostlyaligns with — Requiring periodic effectiveness reports, third-party attestations, and the right to audit enables the organization to understand, record, and prioritize risks posed by each supplier.
- GV.SC-03partialaligns with — Incorporating supplier security controls and risk criteria into contractual terms supports integration of supply-chain risk management into broader cybersecurity and enterprise risk processes.
- ID.RA-10partialaligns with — Contractual provisions for screening, attestations, and audit rights help ensure critical suppliers are assessed before and during the relationship.
- RS.CO-03partialaligns with — Specifying incident notification and collaboration procedures in supplier agreements facilitates sharing of incident information with designated external stakeholders.
- GV.SC-03governs — GV.SC-03 names the outcome of integrating supply-chain cybersecurity risk into enterprise processes; A.5.20 directly operationalizes that outcome by mandating supplier agreements address information security, which is the principal technical means within the supply-chain-risk domain.
- GV.SC-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- ID.RA-10governs — A.5.20's governance mandate to maintain agreed security levels in supplier relationships directly encompasses the supplier assessment outcome named in ID.RA-10 as a core means within that domain
- ID.RA-10implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- RS.CO-03governs — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- RS.CO-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.4mostlyaligns with — The ISO requirement to define an allowlist of permitted external resources and systems in supplier agreements directly supports the ASVS mandate that the application only communicates with explicitly approved external entities.
- V13.2.5mostlyaligns with — Specifying in contracts the resources or systems the supplier may reach implements the ASVS control that restricts the web or application server to an allowlist of outbound destinations.
- V13.3.1partialaligns with — Requiring suppliers to use a secrets-management solution and to demonstrate control effectiveness through attestations aligns with the ASVS expectation that backend secrets are created, stored, and destroyed inside a key vault or equivalent.
- V13.3.2partialaligns with — Contractual clauses that enforce least-privilege access to secret assets for supplier personnel mirror the ASVS requirement that access to secrets follows the principle of least privilege.
- V13.3.4partialaligns with — Mandating periodic reports on control effectiveness and timely remediation of issues in supplier agreements supports the ASVS rule that secrets must expire and be rotated according to documented policy.
- V16.3.3partialaligns with — Including incident-management and notification obligations in supplier contracts helps ensure that attempts to bypass security controls are logged and escalated as required by ASVS.
Related weaknesses / CWE (10)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-284nonemitigates — Requiring explicit access-control obligations and authorization/removal procedures in supplier agreements stops the supplier from obtaining or retaining unauthorized access to the organization's information assets.
- CWE-673nonemitigates — Contractual clauses can restrict suppliers from redefining control boundaries.
- CWE-1103mitigates — Supplier agreements can mandate platform-independence or portability clauses for third-party components.
- CWE-1329mitigates — Supplier agreements can stipulate patchability or end-of-life support, yet the weakness is rooted in product architecture rather than contractual clauses.
- CWE-1357prevents — Supplier agreements can mandate security, reliability and updateability requirements for components.
- CWE-200prevents — Specifying classification mapping, handling rules, and audit rights reduces the likelihood that sensitive data will be exposed to supplier personnel who should not see it.
Mitigated MITRE ATT&CK techniques (160)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Prevented OWASP Web Top 10 (2025) risks (6)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.