[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-19":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-19","Annex A 5.19","ISO\u002FIEC 27001:2022 Annex A 5.19: Information security in supplier relationships",18,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to define and apply processes for managing information security risks associated with using suppliers' products and services. The aim is to keep an agreed level of security in relationships where suppliers handle, access or support the organisation's information.\n\n**In practice.** Good practice includes a supplier security policy, a classification of suppliers by the access and criticality involved, and proportionate due diligence before onboarding. Security requirements are agreed according to risk, and suppliers are managed over the life of the relationship, including offboarding. Auditors look for a supplier register with risk ratings, assessments and evidence that the process is followed for new suppliers.\n\n**Common gaps.** Common gaps are a supplier register that misses cloud and SaaS providers, assessment only at onboarding and no process for ending relationships securely. Responsibility is also often split between procurement and security without anyone owning the whole process.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":23,"title":24,"published_at":25},"outdated-systems-and-weak-security-controls-lead-to-350000-gdpr-fine-in-greek-health-financial-data-","Outdated Systems and Weak Security Controls Lead to €350,000 GDPR Fine in Greek Health & Financial Data Breach","2026-10-08T16:21:27.51+00:00",{"slug":27,"title":28,"published_at":29},"third-party-access-exposes-88-million-danes-national-id-data","Third-Party Access Exposes 8.8 Million Danes' National ID Data","2026-10-06T08:21:29.589+00:00",{"slug":31,"title":32,"published_at":33},"vodafone-espaa-fined-750k-for-gdpr-failures-including-false-encryption-claims","Vodafone España Fined €750K for GDPR Failures Including False Encryption Claims","2026-09-23T10:21:14.93+00:00",{"slug":35,"title":36,"published_at":37},"vodafone-espaa-fined-750k-for-inadequate-third-party-data-processor-controls","Vodafone España Fined €750K for Inadequate Third-Party Data Processor Controls","2026-09-22T16:22:35.502+00:00",{"slug":39,"title":40,"published_at":41},"vodafone-espaa-fined-750k-for-allowing-processor-to-operate-without-valid-data-processing-agreement","Vodafone España Fined €750K for Allowing Processor to Operate Without Valid Data Processing Agreement","2026-09-22T12:22:41.69+00:00",{"slug":43,"title":44,"published_at":45},"football-club-ticket-platform-vulnerability-exposes-fan-data-gdpr-violations-upheld","Football Club Ticket Platform Vulnerability Exposes Fan Data, GDPR Violations Upheld","2026-09-16T09:21:36.443+00:00",{"slug":47,"title":48,"published_at":49},"greece-hdpa-fines-ministry-and-processor-after-25m-record-breach-tied-to-known-vulnerabilities","Greece HDPA Fines Ministry and Processor After 2.5M-Record Breach Tied to Known Vulnerabilities","2026-09-08T12:21:44.035+00:00",{"slug":51,"title":52,"published_at":53},"350000-gdpr-fine-after-breach-exposes-25-million-records-in-greece","€350,000 GDPR Fine After Breach Exposes 2.5 Million Records in Greece","2026-09-08T10:20:20.279+00:00",{"slug":55,"title":56,"published_at":57},"outdated-systems-at-processor-cause-25m-person-greek-data-breach","Outdated Systems at Processor Cause 2.5M-Person Greek Data Breach","2026-09-03T14:21:15.387+00:00",{"slug":59,"title":60,"published_at":61},"60000-fine-for-ignoring-gdpr-corrective-order-on-processor-agreement","€60,000 Fine for Ignoring GDPR Corrective Order on Processor Agreement","2026-08-21T14:21:56.046+00:00",{"slug":63,"title":64,"published_at":65},"ex-processor-retains-46m-user-records-after-contract-ends-fined-1m","Ex-Processor Retains 46M User Records After Contract Ends, Fined €1M","2026-08-21T10:20:40.521+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",10,{"slug":73,"name":74,"problem":75,"stories":76},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",7,{"slug":78,"name":79,"problem":80,"stories":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":83,"name":84,"problem":85,"stories":86},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",4,{"slug":88,"name":89,"problem":90,"stories":91},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",3,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,[98,104,110,114,120,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","28","Article 28","Processor",17,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","15","Control 15","Service Provider Management",14,{"family":99,"item":111,"code":112,"title":113,"together":109},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-800-53","sa-9","SA-9","External System Services",13,{"family":99,"item":121,"code":122,"title":123,"together":124},"32","Article 32","Security of processing",12,{"family":126,"item":127,"code":128,"title":128,"together":129},"itil","overview","ITIL",11,{"family":99,"item":131,"code":132,"title":133,"together":134},"33","Article 33","Notification of a personal data breach to the supervisory authority",8,{"family":105,"item":136,"code":137,"title":138,"together":139},"3","Control 3","Data Protection",6]