{"id":99027,"date":"2026-10-08T09:00:00","date_gmt":"2026-10-08T07:00:00","guid":{"rendered":"http:\/\/locaterisk.com\/de\/?post_type=wissen&#038;p=99027"},"modified":"2026-08-06T16:22:12","modified_gmt":"2026-08-06T14:22:12","slug":"iso-27001-supplier-relationships","status":"publish","type":"wissen","link":"https:\/\/locaterisk.com\/en\/know\/iso-27001-supplier-relationships\/","title":{"rendered":"ISO 27001 and Supplier Relationships: Requirements, Evidence, and Monitoring"},"content":{"rendered":"<h1 class=\"wp-block-heading\">ISO 27001 and Supplier Relationships: Requirements, Evidence, and Monitoring<\/h1>\n\n<span class=\"lr-ai-disclosure\" style=\"display:block;max-width:843px;margin:8px auto 28px;font-size:14px;line-height:1.4;color:#8b93a7;font-family:inherit;font-style:italic;\">This text was generated using artificial intelligence (AI).<\/span>\n\n<p class=\"wp-block-paragraph\">Suppliers process information, operate platforms, develop software, and gain access to systems. An information security management system must classify the resulting risks within its scope and risk treatment. ISO\/IEC 27001:2022 defines requirements for an ISMS. ISO\/IEC 27002:2022 provides implementation guidelines for information security controls.<\/p>\n<p class=\"wp-block-paragraph\">The standards do not prescribe the same supplier process for every organization. Selection and design of the controls follow the specific context and the assessed risks. This article paraphrases publicly verifiable control topics. It neither reflects the text of the standard nor replaces a licensed standard edition, certification consulting, or legal advice.<\/p>\n<h2 class=\"wp-block-heading\">Key Points at a Glance<\/h2>\n<ul class=\"wp-block-list\"><li>ISO\/IEC 27001 addresses supplier risks within the framework of the risk-based ISMS; ISO\/IEC 27002 provides practical orientation for the associated controls.<\/li><li>Controls 5.19 to 5.23 concern supplier relationships, agreements, ICT supply chains, monitoring and changes, as well as cloud usage.<\/li><li>A robust process accompanies selection, contracting, operation, significant changes, and termination of the relationship.<\/li><li>Certificates and questionnaires are possible evidence, but not an automatic proof for every required control in the specific scope.<\/li><li>Technical monitoring complements organizational evidence. An external assessment cannot conclusively evaluate internal processes and contractual obligations.<\/li><\/ul>\n<h2 class=\"wp-block-heading\">Correctly classify ISO\/IEC 27001, 27002, and 27036.<\/h2>\n<p class=\"wp-block-paragraph\">ISO\/IEC 27001 is the certifiable requirement standard for information security management systems. According to ISO, a compliant ISMS should address risks to confidentiality, integrity, and availability with a risk management process tailored to size and needs. Certification relates to the defined ISMS scope of an organization, not automatically to every product, location, or supplier.<\/p>\n<p class=\"wp-block-paragraph\">ISO\/IEC 27002 is not a stand-alone certifiable standard. ISO describes it as a guideline with best practices and control objectives for information security. Controls 5.19 to 5.23 form a cohesive area for suppliers and cloud usage in the 2022 edition. A company must assess their relevance in its own risk context and document the chosen treatment transparently.<\/p>\n<p class=\"wp-block-paragraph\">The ISO\/IEC 27036 series deepens supplier relationships. Part 1 explains overview and concepts from the perspective of the procurer and supplier. Part 2 contains basic requirements for the definition, operation, monitoring, review, maintenance, and improvement of such relationships. Part 3 provides guidelines for multi-tier supply chains of hardware, software, and services. Part 4 addresses risks in the procurement and provision of cloud services.<\/p>\n<p class=\"wp-block-paragraph\">ISO\/IEC 27036 does not replace ISO\/IEC 27001. The series can help those responsible to design supplier processes and ICT supply chains in more detail. Which parts are applied depends on products, services, contractual roles, and risks.<\/p>\n<h2 class=\"wp-block-heading\">Controls 5.19 to 5.23 as a process chain.<\/h2>\n<p class=\"wp-block-paragraph\">Control numbers alone are not a checklist for blanket conformity. They mark topics that should be interconnected in risk treatment. The following table uses analogous brief descriptions and does not contain standard text.<\/p>\n<figure class=\"wp-block-table\"><table><thead><tr><th>Control<\/th><th>Topic in analogous brief form<\/th><th>Practical guiding question<\/th><th>Possible evidence<\/th><\/tr><\/thead><tbody><tr><td>5.19<\/td><td>Security framework for cooperation with suppliers<\/td><td>How are risks, roles, and rules defined for different types of suppliers?<\/td><td>Policy, inventory, criticality, and risk assessment<\/td><\/tr><tr><td>5.20<\/td><td>Binding security rules for service procurement<\/td><td>What requirements and responsibilities are bindingly agreed?<\/td><td>Contract, security measures, service and reporting obligations<\/td><\/tr><tr><td>5.21<\/td><td>Risk control across multiple ICT supply tiers<\/td><td>How are risks from components, subcontractors, and multiple supply tiers managed?<\/td><td>Supply Chain Information, Development and Change Evidence<\/td><\/tr><tr><td>5.22<\/td><td>Continuous Monitoring and Handling of Performance Changes<\/td><td>How are performance, security, deviations, and significant changes tracked?<\/td><td>Reviews, Metrics, Incidents, Actions, and Change Approvals<\/td><\/tr><tr><td>5.23<\/td><td>Secure Selection and Use of Cloud Services<\/td><td>How is the selection, use, operation, and termination of a cloud service securely managed?<\/td><td>Cloud Risk Assessment, Role Model, Configuration, and Exit Plan<\/td><\/tr><\/tbody><\/table><\/figure>\n<p class=\"wp-block-paragraph\">Control 5.19 establishes the organizational framework. This results in risk-appropriate requirements for 5.20. For ICT products and services, 5.21 expands the view beyond the direct contracting partner. 5.22 keeps the assessment up to date during operations. 5.23 adds cloud-specific questions, such as shared responsibilities, administration, data locations, changes, and termination.<\/p>\n<p class=\"wp-block-paragraph\">The evidence column shows possible proofs, not a binding minimum list. Auditors assess whether the chosen controls fit the risk, are implemented, and work within the defined scope. An existing contract without active monitoring is just as insufficient as a technical measurement value without a responsible process.<\/p>\n<h2 class=\"wp-block-heading\">From Supplier Inventory to Requirements and Contract<\/h2>\n<p class=\"wp-block-paragraph\">The lifecycle begins with a maintained inventory. It assigns contracting partners, sourced performance, internal owner, duration, data types, system accesses, subcontractors, and supported business processes. Criticality determines the depth of review and approval. Criteria can include impact of failure, access to sensitive information, interchangeability, concentration, and technical dependency.<\/p>\n<p class=\"wp-block-paragraph\">Before signing a contract, the company checks whether a provider can meet the risk-related requirements. Self-disclosures, certificates, audit reports, technical information, references, and conversations provide different forms of evidence. An ISO\/IEC 27001 certificate is only meaningful within the documented scope and period. Therefore, check certified organizations, scope, locations, exclusions, and validity.<\/p>\n<p class=\"wp-block-paragraph\">The agreement translates relevant requirements into responsibilities and verifiable rules. Typical topics include permitted use and protection of information, access control, security incidents, vulnerabilities, subcontractors, audit and information rights, return or deletion of data, and support during exit. The specific contract design belongs in the hands of the responsible legal and professional functions.<\/p>\n<p class=\"wp-block-paragraph\">A standard catalog facilitates procurement but must not obscure criticality and type of performance. For a cloud operator with administrative access, different evidences and escalations are appropriate than for a supplier without system or data access. Deviations from the standard require a documented risk assessment, decision, and possibly compensatory measures.<\/p>\n<p class=\"wp-block-paragraph\">A structured <a href=\"https:\/\/locaterisk.com\/en\/landing\/third-party-risk-management\/\">Third-Party Risk Management Process<\/a> can connect inventory, criticality, due diligence, measures, and approvals. It must be aligned with the ISMS risk process to ensure that supplier risks do not remain in a separate database without a risk owner.<\/p>\n<h2 class=\"wp-block-heading\">Deepening ICT Supply Chains and Cloud Services<\/h2>\n<p class=\"wp-block-paragraph\">ICT supply chains are multi-tiered. The direct provider may utilize software components, platform services, data centers, or support services from other parties. ISO\/IEC 27036-3:2023 explicitly addresses risks from spatially distributed and multi-tiered supply chains for hardware, software, and services. The goal is better visibility of dependencies and an appropriate handling of risks, not the claim of a supply chain known at all times.<\/p>\n<p class=\"wp-block-paragraph\">Practically, the procurer should clarify which subcontractors or components are relevant for the sourced performance, how changes are communicated, and who addresses vulnerabilities. In software, development and update processes, origins of components, support periods, and security notifications can be relevant. The level of detail achievable and appropriate depends on market position, criticality, and contract model.<\/p>\n<p class=\"wp-block-paragraph\">Cloud services require a clear division of responsibilities. The provider secures the levels it controls; the customer remains responsible, depending on the service model, for identities, permissions, configurations, data, and its own applications. ISO\/IEC 27036-4 provides guidance on risks when acquiring and providing cloud services. ISO\/IEC 27017 supplements control guidelines for cloud customers and cloud providers.<\/p>\n<p class=\"wp-block-paragraph\">For selection, data processing, administrative accesses, logging, encryption, backup, recovery, portability, and exit need to be examined. Rapid changes in functionality and contracts also require a process. An approval at the beginning says little about a service that may be significantly expanded later.<\/p>\n<p class=\"wp-block-paragraph\">An external technical evaluation can complement publicly accessible resources and observable security features of a provider. A <a href=\"https:\/\/locaterisk.com\/en\/know\/what-is-a-security-rating\/\">Security Rating<\/a> makes selected signals and trends comparable. It does not recognize every subcontractor nor necessarily the specifically vulnerable software version, and does not confirm any internal cloud controls.<\/p>\n<h2 class=\"wp-block-heading\">Evidence, Monitoring, and Changes in Operations<\/h2>\n<p class=\"wp-block-paragraph\">After onboarding, the supplier risk changes. Services are expanded, subcontractors change, certificates expire, and new technical exposures arise. Monitoring therefore connects organizational events, performance data, security reports, and technical signals. Rhythm and depth depend on criticality and speed of change.<\/p>\n<p class=\"wp-block-paragraph\">Suitable evidence may include current certificates, audit or inspection reports, service reviews, key figures, incident reports, action plans, and technical evaluations. Each piece of evidence has limitations. An audit report pertains to a defined timeframe and scope. A questionnaire provides a self-disclosure. An external perspective captures publicly observable characteristics. A reliable evaluation documents source, date, scope, and open questions.<\/p>\n<p class=\"wp-block-paragraph\">Change management requires triggers. These include new types of data, additional system accesses, site or control changes, new subcontractors, significant disruptions, security incidents, and changed services. The internal owner assesses together with information security, purchasing, data protection, and legal whether a new risk assessment, contract amendment, or approval is necessary.<\/p>\n<p class=\"wp-block-paragraph\">Technical monitoring should not create automatic liability. A new finding is first attributed and validated. This is followed by inquiries, actions, deadlines, and re-evaluations. The approach of <a href=\"https:\/\/locaterisk.com\/en\/landing\/vendor-risk-management-made-easy\/\">Vendor Risk Management with LocateRisk<\/a> can scale external observation. Organizational evidence, contractual decisions, and internal approvals remain separate tasks.<\/p>\n<p class=\"wp-block-paragraph\">Control metrics distinguish process and risk. Process metrics indicate overdue reviews, missing owners, or expired evidence. Risk metrics consider open high findings, recurring deviations, or concentrations. An average value should not obscure critical individual relationships.<\/p>\n<h2 class=\"wp-block-heading\">Exit as well as demarcation from NIS2 and DORA<\/h2>\n<p class=\"wp-block-paragraph\">A supplier relationship does not end with termination. Accesses, keys, certificates, interfaces, data copies, and forwarding must be handled carefully. The contract and the exit plan clarify data return, deletion, handover, residual obligations, and support during a provider change. For critical services, the feasibility of the exit should be verified before a disruption.<\/p>\n<p class=\"wp-block-paragraph\">ISO\/IEC 27001 is a voluntarily usable management system standard and does not replace applicable law. The NIS2 directive requires security of the supply chain, among other things, for affected essential and important entities, including relationships with direct suppliers and service providers. Which German obligations apply to a specific organization must be verified against the current law and impact. The contribution to <a href=\"https:\/\/locaterisk.com\/en\/know\/nis2-supply-chain-security\/\">NIS2 Supply Chain Security<\/a> explains the regulatory context.<\/p>\n<p class=\"wp-block-paragraph\">DORA applies to financial companies covered in its Article 2 and addresses the ICT third-party risk with detailed requirements for governance, contract lifecycle, registers, monitoring, and exit. The Delegated Regulation (EU) 2024\/1773 specifies the policy for ICT services that support critical or important functions. An ISO-based supplier program can contribute evidence and processes but does not automatically demonstrate DORA compliance. Further details are provided in the article on <a href=\"https:\/\/locaterisk.com\/en\/know\/dora-ict-third-party-risk\/\">Third-Party ICT Risk Under DORA<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">For practice, a common process basis with regulatory extensions is recommended. Inventory, criticality, risk assessment, contracts, monitoring, and exit are managed centrally. Additional legal or industry requirements complement fields, approvals, deadlines, and evidence. This keeps responsibilities consistent without equating ISO certification and legal compliance.<\/p>\n<p class=\"wp-block-paragraph\">An effective supplier process shows not only documents in the audit. It can explain why a third party is critical, what requirements were agreed upon, how changes are detected, and how open risks are addressed. It is precisely this connection of decision, evidence, and operation that makes the controls robust.<\/p>\n\n<div class=\"wp-block-lr-faq-module\"><div class=\"content\"><h3>Frequently asked questions<\/h3><div class=\"faq-topic\"><hr\/><div class=\"collapsible-title\"><a class=\"pr-4\">Which ISO 27001 controls affect supplier relationships?<\/a><img class=\"collapse-toggle\" srcset=\"http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@3x.png 3x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@2x.png 2x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus.png 1x\"\/><\/div><div class=\"collapsible-content\"><p class=\"font-normal\">In the 2022 edition, controls 5.19 to 5.23 address supplier relationships, security requirements in agreements, the ICT supply chain, monitoring and changes in supplier services, as well as the secure use of cloud services.<\/p><\/div><\/div><div class=\"faq-topic\"><hr\/><div class=\"collapsible-title\"><a class=\"pr-4\">Is an ISO 27001 certificate from the supplier sufficient as evidence?<\/a><img class=\"collapse-toggle\" srcset=\"http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@3x.png 3x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@2x.png 2x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus.png 1x\"\/><\/div><div class=\"collapsible-content\"><p class=\"font-normal\">Not alone. Check the organization, scope, locations, validity, and relevance to the provided service. Depending on the risk, additional evidence such as audit reports, technical information, contracts, service reviews, or action plans may be required.<\/p><\/div><\/div><div class=\"faq-topic\"><hr\/><div class=\"collapsible-title\"><a class=\"pr-4\">What role does ISO\/IEC 27036 play?<\/a><img class=\"collapse-toggle\" srcset=\"http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@3x.png 3x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@2x.png 2x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus.png 1x\"\/><\/div><div class=\"collapsible-content\"><p class=\"font-normal\">The standard series deepens information security in supplier relationships. It addresses fundamentals, requirements for relationships between purchasers and suppliers, multi-tier supply chains for hardware, software, and services, as well as cloud services.<\/p><\/div><\/div><div class=\"faq-topic\"><hr\/><div class=\"collapsible-title\"><a class=\"pr-4\">How often should suppliers be reviewed?<\/a><img class=\"collapse-toggle\" srcset=\"http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@3x.png 3x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@2x.png 2x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus.png 1x\"\/><\/div><div class=\"collapsible-content\"><p class=\"font-normal\">The frequency should depend on criticality, risk, and change. In addition to planned reviews, triggers such as new services or accesses, security incidents, subcontractor changes, expiring evidence, and significant technical changes are suitable.<\/p><\/div><\/div><div class=\"faq-topic\"><hr\/><div class=\"collapsible-title\"><a class=\"pr-4\">Does an ISO 27001 certification automatically demonstrate NIS2 or DORA compliance?<\/a><img class=\"collapse-toggle\" srcset=\"http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@3x.png 3x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus@2x.png 2x,http:\/\/locaterisk.com\/wp-content\/plugins\/locate-risk-prod\/lr-blocks\/faq-module\/img\/ic-plus.png 1x\"\/><\/div><div class=\"collapsible-content\"><p class=\"font-normal\">No. An ISMS can support relevant processes and evidence. However, NIS2 and DORA have their own application areas and legal requirements. Impact and implementation must be examined separately.<\/p><\/div><\/div><\/div><\/div>\n\n<p class=\"wp-block-paragraph\">Do you want to continuously monitor the external security situation of your suppliers and integrate it into your ISMS as evidence? Learn more about <a href=\"https:\/\/locaterisk.com\/en\/landing\/vendor-risk-management-made-easy\/\">Vendor Risk Management with LocateRisk<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>How ISO 27001 Structures Supplier Relationships: Risk Assessment, Agreements, ICT Supply Chain, Cloud, Evidence, Monitoring, and Exit.<\/p>","protected":false},"author":6,"featured_media":0,"template":"","wissen_thema":[819],"class_list":["post-99027","wissen","type-wissen","status-publish","hentry","wissen_thema-regulatorik-compliance"],"yoast_head":"<title>ISO 27001 und Lieferantenbeziehungen \u2013 LocateRisk<\/title>\n<meta name=\"description\" content=\"ISO 27001 bei Lieferanten: Controls 5.19 bis 5.23, Vertr\u00e4ge, ICT-Lieferkette, Cloud, Nachweise, Monitoring, \u00c4nderungen und Exit erkl\u00e4rt.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/locaterisk.com\/en\/know\/iso-27001-supplier-relationships\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ISO 27001 und Lieferantenbeziehungen \u2013 LocateRisk\" \/>\n<meta property=\"og:description\" content=\"ISO 27001 bei Lieferanten: Controls 5.19 bis 5.23, Vertr\u00e4ge, ICT-Lieferkette, Cloud, Nachweise, Monitoring, \u00c4nderungen und Exit erkl\u00e4rt.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/locaterisk.com\/en\/know\/iso-27001-supplier-relationships\/\" \/>\n<meta property=\"og:site_name\" content=\"LocateRisk\" \/>\n<meta property=\"og:image\" content=\"https:\/\/locaterisk.com\/wp-content\/uploads\/2020\/11\/Kettenglieder_Generisch_03-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1080\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/locaterisk.com\\\/wissen\\\/iso-27001-lieferantenbeziehungen\\\/\",\"url\":\"https:\\\/\\\/locaterisk.com\\\/wissen\\\/iso-27001-lieferantenbeziehungen\\\/\",\"name\":\"ISO 27001 und Lieferantenbeziehungen \u2013 LocateRisk\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#website\"},\"datePublished\":\"2026-10-08T07:00:00+00:00\",\"description\":\"ISO 27001 bei Lieferanten: Controls 5.19 bis 5.23, Vertr\u00e4ge, ICT-Lieferkette, Cloud, Nachweise, Monitoring, \u00c4nderungen und Exit erkl\u00e4rt.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/locaterisk.com\\\/wissen\\\/iso-27001-lieferantenbeziehungen\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/locaterisk.com\\\/wissen\\\/iso-27001-lieferantenbeziehungen\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/locaterisk.com\\\/wissen\\\/iso-27001-lieferantenbeziehungen\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/locaterisk.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Wissen\",\"item\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/wissen\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"ISO 27001 und Lieferantenbeziehungen: Anforderungen, Nachweise und Monitoring\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/\",\"name\":\"LocateRisk\",\"description\":\"IT-Sicherheit messen und vergleichen\",\"publisher\":{\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#organization\",\"name\":\"LocateRisk\",\"url\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/locaterisk.com\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/Kettenglieder_V0216-9.jpg\",\"contentUrl\":\"https:\\\/\\\/locaterisk.com\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/Kettenglieder_V0216-9.jpg\",\"width\":1920,\"height\":1080,\"caption\":\"LocateRisk\"},\"image\":{\"@id\":\"https:\\\/\\\/locaterisk.com\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/locaterisk\\\/\"]}]}<\/script>","yoast_head_json":{"title":"ISO 27001 and Supplier Relationships \u2013 LocateRisk","description":"ISO 27001 at Suppliers: Controls 5.19 to 5.23, Contracts, ICT Supply Chain, Cloud, Evidence, Monitoring, Changes and Exit Explained.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/locaterisk.com\/en\/know\/iso-27001-supplier-relationships\/","og_locale":"en_US","og_type":"article","og_title":"ISO 27001 und Lieferantenbeziehungen \u2013 LocateRisk","og_description":"ISO 27001 bei Lieferanten: Controls 5.19 bis 5.23, Vertr\u00e4ge, ICT-Lieferkette, Cloud, Nachweise, Monitoring, \u00c4nderungen und Exit erkl\u00e4rt.","og_url":"https:\/\/locaterisk.com\/en\/know\/iso-27001-supplier-relationships\/","og_site_name":"LocateRisk","og_image":[{"width":1080,"height":1080,"url":"https:\/\/locaterisk.com\/wp-content\/uploads\/2020\/11\/Kettenglieder_Generisch_03-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/locaterisk.com\/wissen\/iso-27001-lieferantenbeziehungen\/","url":"https:\/\/locaterisk.com\/wissen\/iso-27001-lieferantenbeziehungen\/","name":"ISO 27001 and Supplier Relationships \u2013 LocateRisk","isPartOf":{"@id":"https:\/\/locaterisk.com\/de\/#website"},"datePublished":"2026-10-08T07:00:00+00:00","description":"ISO 27001 at Suppliers: Controls 5.19 to 5.23, Contracts, ICT Supply Chain, Cloud, Evidence, Monitoring, Changes and Exit Explained.","breadcrumb":{"@id":"https:\/\/locaterisk.com\/wissen\/iso-27001-lieferantenbeziehungen\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/locaterisk.com\/wissen\/iso-27001-lieferantenbeziehungen\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/locaterisk.com\/wissen\/iso-27001-lieferantenbeziehungen\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/locaterisk.com\/"},{"@type":"ListItem","position":2,"name":"Wissen","item":"https:\/\/locaterisk.com\/de\/wissen\/"},{"@type":"ListItem","position":3,"name":"ISO 27001 und Lieferantenbeziehungen: Anforderungen, Nachweise und Monitoring"}]},{"@type":"WebSite","@id":"https:\/\/locaterisk.com\/de\/#website","url":"https:\/\/locaterisk.com\/de\/","name":"LocateRisk","description":"Measure and compare IT security","publisher":{"@id":"https:\/\/locaterisk.com\/de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/locaterisk.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/locaterisk.com\/de\/#organization","name":"LocateRisk","url":"https:\/\/locaterisk.com\/de\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/locaterisk.com\/de\/#\/schema\/logo\/image\/","url":"https:\/\/locaterisk.com\/wp-content\/uploads\/2020\/11\/Kettenglieder_V0216-9.jpg","contentUrl":"https:\/\/locaterisk.com\/wp-content\/uploads\/2020\/11\/Kettenglieder_V0216-9.jpg","width":1920,"height":1080,"caption":"LocateRisk"},"image":{"@id":"https:\/\/locaterisk.com\/de\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/locaterisk\/"]}]}},"_links":{"self":[{"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/wissen\/99027","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/wissen"}],"about":[{"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/types\/wissen"}],"author":[{"embeddable":true,"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/users\/6"}],"version-history":[{"count":1,"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/wissen\/99027\/revisions"}],"predecessor-version":[{"id":99035,"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/wissen\/99027\/revisions\/99035"}],"wp:attachment":[{"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/media?parent=99027"}],"wp:term":[{"taxonomy":"wissen_thema","embeddable":true,"href":"https:\/\/locaterisk.com\/en\/wp-json\/wp\/v2\/wissen_thema?post=99027"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}