[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-19":3},{"item":4,"lessons":16,"controls":67,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-19","Annex A 5.19","ISO\u002FIEC 27001:2022 Annex A 5.19: Information security in supplier relationships",18,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to define and apply processes for managing information security risks associated with using suppliers' products and services. The aim is to keep an agreed level of security in relationships where suppliers handle, access or support the organisation's information.\n\n**In practice.** Good practice includes a supplier security policy, a classification of suppliers by the access and criticality involved, and proportionate due diligence before onboarding. Security requirements are agreed according to risk, and suppliers are managed over the life of the relationship, including offboarding. Auditors look for a supplier register with risk ratings, assessments and evidence that the process is followed for new suppliers.\n\n**Common gaps.** Common gaps are a supplier register that misses cloud and SaaS providers, assessment only at onboarding and no process for ending relationships securely. Responsibility is also often split between procurement and security without anyone owning the whole process.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},36,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"hardware-implants-in-reseller-wallets-highlight-supply-chain-risks","Hardware Implants in Reseller Wallets Highlight Supply Chain Risks","2026-11-13T20:20:40.226+00:00",{"slug":24,"title":25,"published_at":26},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":28,"title":29,"published_at":30},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":32,"title":33,"published_at":34},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":36,"title":37,"published_at":38},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","2026-11-13T11:21:34.52+00:00",{"slug":40,"title":41,"published_at":42},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",{"slug":44,"title":45,"published_at":46},"maersk-ransomware-hit-stems-from-unretired-legacy-system-inherited-in-acquisition","Maersk Ransomware Hit Stems from Unretired Legacy System Inherited in Acquisition","2026-11-12T19:20:58.818+00:00",{"slug":48,"title":49,"published_at":50},"third-party-ai-vendor-breach-exposes-notion-customer-chat-data","Third-Party AI Vendor Breach Exposes Notion Customer Chat Data","2026-11-12T12:21:15.592+00:00",{"slug":52,"title":53,"published_at":54},"acquired-it-systems-become-a-data-breach-vector-for-maersk","Acquired IT Systems Become a Data Breach Vector for Maersk","2026-11-12T09:20:20.555+00:00",{"slug":56,"title":57,"published_at":58},"third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","2026-11-12T00:20:24.197+00:00",{"slug":60,"title":61,"published_at":62},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts-1794432025691","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","2026-11-11T21:20:25.576+00:00",{"slug":64,"title":65,"published_at":66},"legacy-systems-from-acquisitions-become-ransomware-entry-points","Legacy Systems from Acquisitions Become Ransomware Entry Points","2026-11-11T17:20:40.584+00:00",[68,72,77,82,87,91],{"slug":69,"name":70,"problem":71,"stories":9},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":73,"name":74,"problem":75,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",17,{"slug":78,"name":79,"problem":80,"stories":81},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",6,{"slug":83,"name":84,"problem":85,"stories":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":88,"name":89,"problem":90,"stories":86},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":92,"name":93,"problem":94,"stories":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,102,108,114,119,124,129,134],{"family":97,"item":98,"code":99,"title":100,"together":101},"nist-800-53","sa-9","SA-9","External System Services",23,{"family":103,"item":104,"code":105,"title":106,"together":107},"gdpr","28","Article 28","Processor",21,{"family":109,"item":110,"code":111,"title":112,"together":113},"cis","15","Control 15","Service Provider Management",19,{"family":115,"item":116,"code":117,"title":118,"together":76},"nis2","21-2-d","Article 21(2)(d)","Supply chain security (Article 21(2)(d))",{"family":103,"item":120,"code":121,"title":122,"together":123},"5","Article 5(1)(f)","Principles relating to processing of personal data",14,{"family":103,"item":125,"code":126,"title":127,"together":128},"32","Article 32","Security of processing",12,{"family":130,"item":131,"code":132,"title":132,"together":133},"itil","overview","ITIL",11,{"family":103,"item":135,"code":136,"title":137,"together":138},"33","Article 33","Notification of a personal data breach to the supervisory authority",8]