[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-20":3},{"item":4,"lessons":16,"controls":38,"related":62},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-20","Annex A 5.20","ISO\u002FIEC 27001:2022 Annex A 5.20: Addressing information security within supplier relationships",5,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects relevant information security requirements to be established and agreed with each supplier, based on the type of supplier relationship.\n\n**In practice.** Good practice means contracts or agreements that state the security obligations of the supplier, such as access rules, protection of information, incident notification, use of subcontractors, right to audit or receive assurance and return or deletion of data at the end. The level of detail matches the risk of the relationship. Auditors expect contract templates or clauses, signed agreements for key suppliers and links to the supplier risk assessment.\n\n**Common gaps.** Typical gaps are standard terms accepted from large cloud providers without review, missing incident notification clauses and no requirements on sub-processors.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"vodafone-espaa-fined-750k-for-inadequate-third-party-data-processor-controls","Vodafone España Fined €750K for Inadequate Third-Party Data Processor Controls","2026-09-22T16:22:35.502+00:00",{"slug":23,"title":24,"published_at":25},"vodafone-espaa-fined-750k-for-allowing-processor-to-operate-without-valid-data-processing-agreement","Vodafone España Fined €750K for Allowing Processor to Operate Without Valid Data Processing Agreement","2026-09-22T12:22:41.69+00:00",{"slug":27,"title":28,"published_at":29},"60000-fine-for-ignoring-gdpr-corrective-order-on-processor-agreement","€60,000 Fine for Ignoring GDPR Corrective Order on Processor Agreement","2026-08-21T14:21:56.046+00:00",{"slug":31,"title":32,"published_at":33},"ex-processor-retains-46m-user-records-after-contract-ends-fined-1m","Ex-Processor Retains 46M User Records After Contract Ends, Fined €1M","2026-08-21T10:20:40.521+00:00",{"slug":35,"title":36,"published_at":37},"slovenia-fines-company-for-missing-gdpr-data-processing-agreement-with-service-provider","Slovenia Fines Company for Missing GDPR Data Processing Agreement with Service Provider","2026-08-12T08:21:05.494+00:00",[39,44,48,53,58],{"slug":40,"name":41,"problem":42,"stories":43},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",3,{"slug":45,"name":46,"problem":47,"stories":43},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":49,"name":50,"problem":51,"stories":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",2,{"slug":54,"name":55,"problem":56,"stories":57},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":59,"name":60,"problem":61,"stories":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[63,67,72,77,82,87,91,95],{"family":5,"item":64,"code":65,"title":66,"together":9},"a-5-19","Annex A 5.19","ISO\u002FIEC 27001:2022 Annex A 5.19: Information security in supplier relationships",{"family":68,"item":69,"code":70,"title":71,"together":9},"cis","15","Control 15","Service Provider Management",{"family":73,"item":74,"code":75,"title":76,"together":9},"gdpr","28","Article 28","Processor",{"family":73,"item":78,"code":79,"title":80,"together":81},"5","Article 5(1)(f)","Principles relating to processing of personal data",4,{"family":83,"item":84,"code":85,"title":86,"together":81},"nist-800-53","sa-9","SA-9","External System Services",{"family":88,"item":89,"code":90,"title":90,"together":81},"itil","overview","ITIL",{"family":73,"item":92,"code":93,"title":94,"together":52},"83","Article 83","General conditions for imposing administrative fines",{"family":68,"item":96,"code":97,"title":98,"together":52},"3","Control 3","Data Protection"]