ISO 27001 Annex : A.15.2 Supplier Service Delivery Management

ISO 27001 Annex : A.15.2 Supplier Service Delivery Management It’s objective is to maintain, in compliance with supplier agreements, an agreed level of information security and delivery of service.

A.15.2.1 Monitoring and Review of Supplier Services

Control- Organizations shall monitor, review and audit the provision of service to suppliers on a regular basis.

Implementation Guidance – Monitoring and review of supplier services will ensure respect for the terms and conditions of information security of the arrangement and careful monitoring of incidents and issues related to information security.

This will include a process of service management between the client and the supplier:

Monitor the level of service performance to verify agreement compliance;
Review the supplier’s service reports and schedule progress meetings on a regular basis as required by the agreements;
conduct supplier audits and follow-up on reported problems in conjunction with the analysis of independent auditor reports where available;
Facilitate and review the details regarding safety incidents as provided by agreements and any relevant guidelines and procedures;
review the traces of the manufacturer audit and information security reports, operational issues, failures, fault-tracking and service-related disturbances;
solving and managing any problems identified;
review the security of information aspects of the provider’s relations with their own suppliers;
Ensure that the company retains sufficient service capacity along with working plans to ensure that negotiated rates of service reliability are maintained following significant service or catastrophe failures.

A designated entity or service management team should be entrusted with the responsibility for managing supplier relationships. Moreover, the organization should ensure that suppliers assign responsibilities for compliance review and implementation of the agreement requirements. There should be appropriate technical expertise and resources to track compliance with the requirements of the Agreement, especially with the requirements for information security. If deficiencies in the service delivery are observed, suitable action should be taken.

To order that sensitive and essential information and information processing facilities that a company has access, stored or controlled should be kept to full control and exposure of all security aspects. In the context of a defined reporting procedure, the organization should retain visibility in security activities such as change management, vulnerability identification, and incident reporting and response to information security.

A.15.2.2 Managing Changes to Supplier Services

Control- Change in the provision of services by providers should be managed with the focus on the criticality of enterprise information, systems, processes, and reassessment of risks and should include maintaining and improving existing information security policies, procedures, and controls.

Implementation Guidance – This will take into account the following aspects:

Modifications of arrangements for suppliers;
Implementing changes by the organization:

Improvements to existing offered services;
development of all new systems and applications;
Changes or modifications to the policies and procedures of the organization;
Controls new or updated to address and enhance safety information incidents;

Implementing improvements in supplier services:

Network modification and improvement;
the use of the modern technology;
Current or older releases with existing products;
New technologies and environments for development;
Modification of service center physical location;
Supplier change;
Subcontract to another supplier.

Also Read : ISO 27001 Annex : A.15.1.2 & A.15.1.3

A well-known ISO 27001 Lead Auditor and ISO 27001 Lead Implementer certificate that mainly covers information security clauses and their implementation, i.e., controls which should be implemented by the organization to preserve the CIA triad, Confidentiality, Integrity, and Availability to maintain their critical, sensitive information in a secure manner. Infosavvy, an institute in Mumbai conducts training and certification for multiple domains in Information Security which includes IRCA CQI ISO 27001:2013 Lead Auditor (LA), ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). Infosavvy will help you to understand and recognize the full scope of your organization’s security checks to protect your organization’s activities and information equipment (assets) from attacks, and also to illustrate the controls for securing assets accessible to suppliers of the organization. We have trainers with extensive expertise and experience to ensure the efficient handling of the security of information. Consequently, the applicant will gain the necessary skills for the ISMS audit by using commonly agreed audit concepts, procedures and techniques.

Questions related to this topic

How do you maintain supplier relationships?
What are the types of ISO 27001 Annex : A.15.2 Supplier Service Delivery Management?
What is a buyer supplier relationship?
Why is it important to have a good relationship with suppliers?
What is ISO 27001 Annex : A.15.2 Supplier Service Delivery Management?

ISO 27001 Requirements

Clause 4.1 Understanding the organization and its context

Clause 4.2 Understanding the needs and expectations of interested parties

Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement

ISO 27001 Annex A Controls

About ISO 27002

This Blog Article is posted by

Infosavvy, 5B 306 Riverside Greens, Panvel, Raigad 410206 Maharashtra, India

https://goo.gl/maps/mHkyURHmeFXyGiVw5

Upcoming Training :- ISO27001 LA T. D.:-18th, 19th, & 24th, 25th, 26th Jan 2025.