[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-21":3},{"item":4,"lessons":16,"controls":26,"related":52},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-21","Annex A 5.21","Managing information security in the ICT supply chain",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Processes and procedures should be defined and implemented to manage the information security risks that come with ICT products and services across the supply chain, including suppliers' own suppliers.\n\n**In practice.** For ICT purchases the organisation sets security requirements that suppliers must pass down to their subcontractors, asks about component origin and support lifetime, and expects timely vulnerability information and patches. Critical components may be verified, for example through software bills of materials or supplier attestations. Changes in the supply chain, such as a supplier moving hosting or adding a subcontractor, are tracked. Evidence includes contract clauses, supplier assessments and records of how supply chain risks were assessed and accepted.\n\n**Common gaps.** Most organisations only look at their direct suppliers and know little about the fourth parties behind them. Open source dependencies are often treated as outside the supply chain even though they ship inside critical products.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"fakeagent-campaign-abuses-trusted-claudeai-domain-to-deliver-sectoprat-infostealer","FakeAgent Campaign Abuses Trusted Claude.ai Domain to Deliver SectopRAT Infostealer","2026-07-23T12:21:15.54+00:00",{"slug":23,"title":24,"published_at":25},"ai-data-centers-outpacing-security-the-forge-framework-warns-of-critical-gaps","AI Data Centers Outpacing Security: The 'Forge' Framework Warns of Critical Gaps","2026-07-16T14:21:04.932+00:00",[27,32,36,40,44,48],{"slug":28,"name":29,"problem":30,"stories":31},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":33,"name":34,"problem":35,"stories":31},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":37,"name":38,"problem":39,"stories":31},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":41,"name":42,"problem":43,"stories":31},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":45,"name":46,"problem":47,"stories":31},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":49,"name":50,"problem":51,"stories":31},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,58,63,67,71,75,79,83],{"family":54,"item":55,"code":56,"title":57,"together":9},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":59,"item":60,"code":61,"title":62,"together":9},"nist-800-53","sa-12","SA-12","Supply Chain Protection",{"family":54,"item":64,"code":65,"title":66,"together":31},"15","Control 15","Service Provider Management",{"family":54,"item":68,"code":69,"title":70,"together":31},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":54,"item":72,"code":73,"title":74,"together":31},"7","Control 7","Continuous Vulnerability Management",{"family":54,"item":76,"code":77,"title":78,"together":31},"9","Control 9","Email and Web Browser Protections",{"family":5,"item":80,"code":81,"title":82,"together":31},"a-8-7","Annex A 8.7","ISO\u002FIEC 27001:2022 Annex A 8.7: Protection against malware",{"family":54,"item":84,"code":85,"title":86,"together":31},"13","Control 13","Network Monitoring and Defense"]