Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

Supplier Register

Updated on 2 min Reviewed by: Cenedril-Redaktion
A.5.19A.5.22 ISO 27001NIS2 Art. 21(2)(d)

The supplier register captures all external service providers that have access to your information or IT systems. Each supplier is documented with their security requirements, contractual framework, and the result of the most recent assessment.

ISO 27001 requires managing information security in supplier relationships (A.5.19) and monitoring and reviewing supplier services (A.5.22). NIS2 tightens supply chain security requirements in Art. 21(2)(d). The register is the central tool for implementing these requirements operationally.

What does it contain?

The CSV template covers the supplier relationship from onboarding to regular assessment:

  • Supplier ID and name — unique identifier and company name
  • Type of service — cloud service, development, hosting, consulting, physical services
  • Access to information/systems — which data and systems are affected?
  • Risk rating — low, medium, high, critical
  • Contractual security requirements — DPA, SLA, audit rights, incident notification obligations
  • Certifications — ISO 27001, SOC 2, C5, or other evidence
  • Last assessment and result — date and outcome
  • Next planned assessment — deadline for the next review

How to use it

Inventory all external parties. Start by collecting every service provider that has access to information or systems. Frequently overlooked suppliers include the external accountant with ERP access, the printer vendor with remote maintenance access, and the marketing agency with CRM access.

Risk rating and contract review. Each supplier is assessed based on the risk the relationship poses. High risk ratings require more comprehensive contractual provisions — data processing agreement, security requirements, audit rights, incident notification obligations. Review existing contracts for these clauses and document any gaps.

Ongoing monitoring. Supplier assessments are an ongoing effort. On a defined schedule (annually for standard suppliers, semi-annually or quarterly for critical ones), you check certification status, incident history, and contract compliance. Results flow back into the register and, where needed, into the risk register.

Register Template

Supplier Register

.csv · EN.csv · DE
IDSupplierServiceCategoryCriticalityData AccessedLocationContract StartContract EndDPA SignedCertificationsLast ReviewReview ResultNext ReviewStatusOwner
SUP-001Amazon Web ServicesCloud infrastructure (eu-central-1)IaaSCriticalCustomer database + backupsFrankfurt DE2023-01-012026-12-31YesISO 27001 SOC 2 C52026-01-15Satisfactory2027-01-15ActiveIT Operations Lead
SUP-002MicrosoftM365 + Azure ADSaaSCriticalEmail + files + identityEU cloud2022-06-012026-05-31YesISO 27001 SOC 2 C52025-11-20Satisfactory2026-11-20ActiveISO
SUP-003PersonioHR SaaSSaaSHighEmployee master data payrollMunich DE2023-03-012026-02-28YesISO 270012025-12-01Satisfactory2026-12-01ActiveHR Lead
SUP-004Vendor X LogisticsLogistics portal SaaSSaaSCriticalCustomer shipmentsAmsterdam NL2024-01-012027-12-31YesISO 270012026-02-10Satisfactory - one minor finding2027-02-10ActiveHead of Ops
SUP-005SecureIT GmbHData destructionServiceLowPhysical mediaHamburg DE2022-01-012026-12-31N/ADIN 663992025-09-01Satisfactory2026-09-01ActiveIT Operations Lead
SUP-006CleanOffice GmbHOffice cleaningServiceLowPhysical premisesHamburg DE2023-06-012026-05-31No (NDA only)N/A2025-10-01Satisfactory2026-10-01ActiveFacilities Lead
SUP-007Fortinet (via reseller)Firewall hardware + supportHardware/SupportHighNetwork traffic metadataRemote support2024-01-012027-12-31N/AISO 27001 (vendor)2025-12-10Satisfactory2026-12-10ActiveIT Operations Lead
SUP-008SplunkSIEM SaaSSaaSHighLog data (including PII metadata)EU cloud2023-09-012026-08-31YesISO 27001 SOC 22026-01-25Satisfactory2027-01-25ActiveISO
SUP-009Kanzlei Weber & PartnerLegal counselServiceMediumContract dataHamburg DE2021-01-01RollingYesN/A2025-11-01Satisfactory2026-11-01ActiveCEO
SUP-010KPMGExternal ISMS auditServiceMediumISMS documentationHamburg DE2024-01-012026-12-31N/A (auditor)ISO 170212025-06-01Satisfactory2026-06-01ActiveISO
SUP-011DHL ExpressParcel deliveryServiceLowShipment addressesGlobal2020-01-01RollingYesN/A2025-11-15Satisfactory2026-11-15ActiveHead of Ops
SUP-012Let's Encrypt (ISRG)TLS certificatesServiceMediumPublic keys onlyGlobal2022-01-01RollingN/AWeb PKI audit2026-01-01Satisfactory2027-01-01ActiveIT Operations Lead

Sources

ISO 27001 Controls Covered

A.5.19 Information security in supplier relationships A.5.22 Monitoring, review and change management of supplier services

Frequently asked questions

Which suppliers belong in the register?

All external parties that have access to your organisation's information or IT systems, or that deliver services relevant to your information security. This includes cloud providers, software developers, managed service providers, data centres, but also cleaning services with access to secured areas and document destruction vendors.

How often do I assess my suppliers?

At least annually and on an ad-hoc basis — e.g. after a security incident at the supplier, after material contract changes, or when the threat landscape shifts. Critical suppliers (cloud providers processing core data) warrant more frequent reviews and stricter criteria.

Do I need an ISO 27001 certificate from every supplier?

An ISO 27001 certificate is a strong signal but not a requirement. The standard requires that you manage information security in the supplier relationship — through contract clauses, audits, security questionnaires, or certification evidence. The method must fit the risk: a cloud provider processing customer data needs different assurances than an office supplies vendor.