A.5.20 Organizational
Addressing information security within supplier agreements
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (10)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- SR-3mostlyaligns with — The ISO control operationalizes the NIST requirement to impose and verify supply-chain security controls through contractual terms and ongoing assurance mechanisms.
- AU-6partialaligns with — The agreements mandate periodic reporting on control effectiveness and grant the organization rights to audit supplier processes and records.
- CA-6partialaligns with — Third-party attestations and independent reports on control effectiveness provide evidence that supports ongoing authorization decisions for supplier services.
- IR-4partialaligns with — Incident-management, notification, and collaborative remediation obligations are required elements of the supplier agreements.
- PS-7partialaligns with — Personnel screening, acceptable-use rules, and authorization procedures for supplier staff are explicitly addressed in the supplier-agreement clauses.
- SA-9nonegoverns — Both controls require formal agreements that define security obligations, access rules, monitoring rights, and incident responsibilities when an organization relies on external providers.
Aligned NIST CSF 2.0 outcomes (12)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- GV.SC-05fullcovers — Embedding security obligations, access rules, incident procedures, and audit rights directly into supplier contracts satisfies the CSF requirement to establish and integrate cybersecurity requirements into supplier agreements.
- GV.SC-02mostlyaligns with — Defining roles, contacts, screening, and responsibilities for both the organization and the supplier in the agreement aligns with establishing and coordinating cybersecurity roles across the supply chain.
- GV.SC-07mostlyaligns with — Requiring periodic effectiveness reports, third-party attestations, and the right to audit enables the organization to understand, record, and prioritize risks posed by each supplier.
- GV.SC-03partialaligns with — Incorporating supplier security controls and risk criteria into contractual terms supports integration of supply-chain risk management into broader cybersecurity and enterprise risk processes.
- ID.RA-10partialaligns with — Contractual provisions for screening, attestations, and audit rights help ensure critical suppliers are assessed before and during the relationship.
- RS.CO-03partialaligns with — Specifying incident notification and collaboration procedures in supplier agreements facilitates sharing of incident information with designated external stakeholders.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.4mostlyaligns with — The ISO requirement to define an allowlist of permitted external resources and systems in supplier agreements directly supports the ASVS mandate that the application only communicates with explicitly approved external entities.
- V13.2.5mostlyaligns with — Specifying in contracts the resources or systems the supplier may reach implements the ASVS control that restricts the web or application server to an allowlist of outbound destinations.
- V13.3.1partialaligns with — Requiring suppliers to use a secrets-management solution and to demonstrate control effectiveness through attestations aligns with the ASVS expectation that backend secrets are created, stored, and destroyed inside a key vault or equivalent.
- V13.3.2partialaligns with — Contractual clauses that enforce least-privilege access to secret assets for supplier personnel mirror the ASVS requirement that access to secrets follows the principle of least privilege.
- V13.3.4partialaligns with — Mandating periodic reports on control effectiveness and timely remediation of issues in supplier agreements supports the ASVS rule that secrets must expire and be rotated according to documented policy.
- V16.3.3partialaligns with — Including incident-management and notification obligations in supplier contracts helps ensure that attempts to bypass security controls are logged and escalated as required by ASVS.
Related weaknesses / CWE (13)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1329mostlymitigates — Supplier agreements can stipulate patchability or end-of-life support, yet the weakness is rooted in product architecture rather than contractual clauses.
- CWE-1103partialmitigates — Supplier agreements can mandate platform-independence or portability clauses for third-party components.
- CWE-1357partialprevents — Supplier agreements can mandate security, reliability and updateability requirements for components.
- CWE-200partialprevents — Specifying classification mapping, handling rules, and audit rights reduces the likelihood that sensitive data will be exposed to supplier personnel who should not see it.
- CWE-269nonenone — Defining screening, authorization, and privilege-management obligations in the contract stops suppliers from assigning excessive or inappropriate privileges to their staff.
- CWE-284nonemitigates — Requiring explicit access-control obligations and authorization/removal procedures in supplier agreements stops the supplier from obtaining or retaining unauthorized access to the organization's information assets.
- CWE-673nonemitigates — Contractual clauses can restrict suppliers from redefining control boundaries.
- CWE-732nonenone — Requiring the supplier to implement an agreed set of controls, including access-control and permission settings, prevents incorrect or overly permissive permission assignments on organizational resources.
- CWE-862nonenone — Mandating documented authorization lists and removal procedures ensures every supplier action is preceded by an explicit authorization check, eliminating missing-authorization flaws.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1199mostlyprevents — Requiring explicit authorization lists, screening, and removal procedures for supplier personnel reduces the likelihood that an adversary can leverage a compromised or malicious supplier account to gain initial access through a trusted third-party relationship.
- T1078partialmitigates — Mandating access-control obligations, periodic effectiveness reports, and the right to audit supplier processes limits an adversary’s ability to maintain undetected use of valid supplier credentials or accounts within the organization’s environment.
- T1530partialmitigates — Specifying data-handling, classification, and access-control obligations in supplier agreements restricts an adversary’s ability to collect sensitive data from cloud storage or repositories that the supplier is authorized to access.
- T1087nonemitigates — By defining the exact information and access methods permitted to supplier personnel and requiring classification mapping, the control reduces opportunities for an adversary to discover and enumerate accounts or privileges through supplier channels.
- T1550nonemitigates — Contractual requirements for acceptable-use rules, authorization procedures, and timely revocation of supplier access hinder an adversary’s ability to reuse stolen or illicitly obtained supplier authentication material for lateral movement.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A03mostlymitigates — Requiring suppliers to implement the organization’s security controls, undergo audits, and maintain sub-supplier obligations directly reduces the chance that third-party code, services, or updates introduce vulnerable or malicious components.
- A02partialmitigates — Mandating minimum security requirements for the supplier’s ICT infrastructure and periodic effectiveness reports helps ensure supplier systems are not deployed or maintained with insecure defaults or missing patches.
- A08partialmitigates — Contractual clauses on change management, incident notification, and independent control attestations limit the risk that a supplier silently alters software or data in ways that compromise integrity.
- A09nonemitigates — Explicit incident-management, reporting, and audit obligations create the logging and alerting pathways needed to detect and respond to security events originating from or affecting the supplier.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.