What it asks for. This control expects the organisation to define and apply processes for managing information security risks associated with using suppliers' products and services. The aim is to keep an agreed level of security in relationships where suppliers handle, access or support the organisation's information.
In practice. Good practice includes a supplier security policy, a classification of suppliers by the access and criticality involved, and proportionate due diligence before onboarding. Security requirements are agreed according to risk, and suppliers are managed over the life of the relationship, including offboarding. Auditors look for a supplier register with risk ratings, assessments and evidence that the process is followed for new suppliers.
Common gaps. Common gaps are a supplier register that misses cloud and SaaS providers, assessment only at onboarding and no process for ending relationships securely. Responsibility is also often split between procurement and security without anyone owning the whole process.