ISO 27001 for IT managers 5: suppliers, people and information beyond the server room

Follow a dependency beyond your own team

The scope and risk work should already identify externally provided services and internal dependencies. Bring those records to the relevant owners. Your aim is to establish what each party does, what evidence is available and how changes or failures are handled. A supplier questionnaire returned once is only one input.

Group suppliers by the consequences of failure or misuse of access. A provider holding customer documents or administering identity needs different scrutiny from a low-impact office purchase. Explain the grouping criteria and review them when the service changes. Do not claim that a particular tiering model or annual questionnaire is prescribed for every ISO-certified organisation.

Review the actual service you buy

For a cloud provider, identify the contracted service, legal entity, data locations where relevant, responsibilities, support route, incident contact and exit arrangements. Examine assurance reports or certificates for scope and currency. A valid certificate for a different service does not answer your question, and a supplier's certification does not validate your tenant settings.

At fictional Merefield, the CRM provider hosts the application, while Merefield controls users, exports and integrations. The service owner must decide what information belongs there and who can approve sharing. IT must implement and verify access. Procurement must understand the agreement. Capture that split in one responsibility record.

Ask how you would obtain your data in usable form, remove access and confirm the provider's end-of-service handling. Test a small authorised export before the relationship becomes difficult. A collection of downloaded files is not necessarily a complete operational exit: relationships, metadata, attachments and configuration can matter.

Make people processes demonstrable

Work with HR to define how joiners, movers and leavers reach IT, who approves access and what happens outside normal hours. Test one complete case across the functions. If the notification arrives late, record the process issue rather than giving IT an impossible retrospective target.

Security awareness should help people make decisions they encounter. Use short scenarios: a supplier requests an MFA reset, a colleague asks to share a customer folder, or an AI tool requests access to email. Ask what the employee would do and where they would report concern. An attendance record proves attendance; a scenario can provide additional evidence of understanding.

Competence for specialist responsibilities needs more than general awareness. Identify who can administer critical services, restore data, review logs or conduct internal audits, and what supports that competence. Keep a plan for gaps and staff absence. Do not invent certificates or training history to make a competence matrix look complete.

Connect handling rules to technology

Information owners should agree classification, sharing and retention decisions with appropriate advice. IT translates those decisions into access, configuration and verification. Use the organisation's actual obligations; avoid a universal “keep everything for seven years” rule that creates unnecessary exposure and may not fit the records.

Consider where copies go: downloads, backups, email attachments, exports, AI prompts and search indexes. A deletion in one application may not remove every copy. Record the limitation and the intended process, including any legal hold or retention exception decided by the proper owner.

For AI services, apply the same supplier and access discipline. Identify what the service can read or change, whether information leaves the intended environment, and who authorises the connector. Start with limited permissions and verify revocation. These are practical control choices to assess against your risks; an “AI policy” by itself does not establish safe implementation.

Rehearse an incident involving someone else

Choose a tabletop scenario: the CRM provider reports possible unauthorised access while the delivery director is away. Use fictional information and record the exercise as such. Identify who triages the report, who contacts the provider, who makes customer or regulatory decisions and which alternate person has authority.

Do not set a legal reporting deadline from memory. The obligations register and the organisation's advisers should establish applicable duties and contractual timelines. IT's job is to preserve relevant evidence, provide facts and escalate through the agreed route. Separate confirmed facts from assumptions in the exercise log.

Include the physical working environment

For office and remote work, assess access to equipment, confidential conversations, unattended devices, storage and disposal. Involve facilities and staff who actually use the space. Keep practical arrangements proportionate to risk; do not write a server-room visitor procedure for a site with no server room merely because a template includes one.

Your evidence should connect the arrangement to the risk and its owner. For disposal, trace an actual authorised device through the chosen data-removal and transfer process. A supplier receipt without an asset reference may be hard to reconcile with your inventory.

Completion exercise

Select one important supplier and one people process. Follow each through ownership, agreement, operation and review. Then carry out the tabletop and assign its actions. You should finish with evidence that crosses departmental boundaries, ready for the internal audit in part 6.

Check your understanding