ISO 27001:2022 made supplier and vendor risk management a first-class requirement. Five Annex A controls — 5.19 through 5.23 — now mandate a documented supplier policy, pre-engagement assessments, contractual security requirements, and ongoing monitoring. VendorAuditly automates every one of them so you can pass your certification audit without hiring a GRC consultant.
ISO 27001:2022 replaced the old Annex A.15 with five new controls in the 5.x theme. Here is exactly what each control requires and what evidence a certification body will look for during an audit.
A documented policy defining how your organisation manages information security risks with suppliers. The policy must cover: how suppliers are classified by risk tier, what minimum security requirements apply at each tier, and how those requirements are enforced. Auditors will ask to see the policy document and evidence that it is applied — a policy that exists only on paper fails this control.
Evidence needed: supplier policy + risk-tiered vendor registerSecurity requirements must be formally agreed with each supplier before they access your information or systems. This means security clauses in contracts or data processing agreements — not a verbal understanding. The clauses must cover: data handling obligations, security incident notification timelines, right to audit, and what happens to data on contract termination.
Evidence needed: contracts or DPAs with documented security clausesFor ICT suppliers — software vendors, cloud providers, managed service providers — you must assess not just the direct supplier but also their sub-processors and supply chain dependencies. This control is the “supply chain risk” control: if a critical vendor relies on a sub-processor that handles your data, that sub-processor is in scope. Evidence typically includes sub-processor lists from critical vendors.
Evidence needed: sub-processor documentation from critical ICT vendorsSupplier risk management is not a one-time onboarding exercise — ISO 27001 requires ongoing monitoring and periodic review. This means annual (or more frequent for critical suppliers) security re-assessments, review of supplier security certifications as they expire, tracking changes to supplier services that affect risk, and a record of those reviews. Auditors want to see the review history, not just the current state.
Evidence needed: dated review records + certificate expiry trackingNew in ISO 27001:2022 — cloud services now have their own dedicated control. You must document which cloud services you use, what data they process, what the shared responsibility model means for your security obligations, and how you monitor compliance. Standard cloud provider security documentation (SOC 2 reports, ISO 27001 certificates) counts as evidence here, as long as you have a process for collecting and reviewing it.
Evidence needed: cloud inventory + SOC2/ISO certs from each providerUnderstanding the theory is one thing — passing the audit is another. Certification bodies (BSI, Bureau Veritas, SGS, DNV, Schellman, etc.) follow a consistent pattern when auditing Annex A 5.19–5.23.
Auditors verify you have a written information security policy for supplier relationships. They check it covers risk classification, minimum requirements by tier, and is signed off at management level. A one-page policy is fine — it just needs to exist and be current.
VendorAuditly: policy template + workspace settingsAuditors will ask for your supplier list and expect to see each supplier categorised by risk tier (Critical, High, Medium, Low). They verify the classification rationale makes sense given data access and operational dependency — not that every supplier is “Low.”
VendorAuditly: risk-tiered vendor register with rationaleFor at least two or three suppliers sampled during the audit, auditors want to see evidence that a security assessment was completed before the supplier was granted access. Questionnaire responses, SOC2 report reviews, or third-party attestation all count — with timestamps.
VendorAuditly: questionnaire history with sent/received timestampsAuditors will sample two or three supplier contracts and check for documented security obligations: data handling, breach notification timelines, right to audit, and data deletion clauses. The contract itself is the evidence — or a separately signed security addendum.
VendorAuditly: document storage against each vendor recordThe most commonly failed control in supplier management. Auditors want to see that reviews actually happened — dated records, not just a policy saying they will happen annually. Certificate expiry tracking (insurance, SOC2, ISO 27001) with automated alerts satisfies this.
VendorAuditly: review logs + automated certificate expiry alertsVendorAuditly was built around the evidence artefacts that ISO 27001 auditors look for. Here is the control-by-control mapping.
VendorAuditly’s vendor register assigns every supplier a risk tier (Critical / High / Medium / Low) based on data access level, operational dependency, and assessment score. The tier classification with its rationale is logged and exportable — the artefact auditors ask to see under A.5.19. Workspace settings define your tier thresholds, providing the policy documentation the control requires.
Every vendor record in VendorAuditly has a documents tab where contracts, DPAs, security addenda, and NDAs are stored and linked. When an auditor asks to see the contract for a specific supplier, you pull it in under 30 seconds. Document upload timestamps are preserved, satisfying the “agreed before access” requirement of A.5.20.
VendorAuditly’s questionnaire builder includes an ICT supply chain template that asks critical vendors for their sub-processor list and security controls at sub-processor level. Responses are stored against the vendor record, giving you documented evidence of sub-supply-chain awareness for A.5.21. For cloud providers, you can store their published sub-processor lists directly.
VendorAuditly schedules annual re-assessments for each vendor tier and sends automated alerts at 90/60/30/7 days before certificates expire. Every completed review is timestamped and logged. When auditors ask for evidence of ongoing monitoring, you export the review history report — which shows exactly when each review occurred, who completed it, and what the outcome was.
Tag any vendor as a cloud service provider in VendorAuditly and store their SOC 2 Type II reports, ISO 27001 certificates, and shared responsibility documentation against their record. Automated alerts fire when those certificates approach expiry — so you always have current evidence in the file. The cloud inventory export directly answers auditors’ A.5.23 questions.
The same vendor register, questionnaire records, and monitoring logs that satisfy ISO 27001:2022 Annex A 5.19–5.23 also satisfy NIST C-SCRM GV.SC controls, DORA Article 28, and SOC2 CC9.2. Build it once, use it across all frameworks.
Vendor register, pre-engagement assessments, contract storage, ongoing monitoring, and one-click evidence export. Everything your certification body will ask for.
No credit card required · $49/month · No consultant needed.