[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-22":3},{"item":4,"lessons":16,"controls":23,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-22","Annex A 5.22","Monitoring, review and change management of supplier services",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Regularly monitor, review and evaluate how suppliers deliver services and manage their security practices, and control changes to those services.\n\n**In practice.** Each important supplier has an owner who tracks performance against the agreed security requirements, using service reports, certifications, audit reports, incident notifications and periodic review meetings. Findings feed back into risk assessments, and material changes on either side, such as new subcontractors, hosting locations or service features, go through an assessment before they take effect. Evidence includes a supplier register with criticality ratings, minutes or records of reviews, tracked remediation actions and change assessments.\n\n**Common gaps.** Due diligence is often thorough at contract signature and then stops, so later changes by the supplier go unnoticed. Reviews tend to focus on commercial service levels rather than security, and fourth parties used by the supplier are rarely tracked.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},1,[19],{"slug":20,"title":21,"published_at":22},"ai-powered-security-tools-raise-questions-about-dependency-and-risk","AI-Powered Security Tools Raise Questions About Dependency and Risk","2026-11-12T21:20:37.136+00:00",[24,28,32],{"slug":25,"name":26,"problem":27,"stories":17},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"slug":29,"name":30,"problem":31,"stories":17},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":33,"name":34,"problem":35,"stories":17},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[37,42,47],{"family":38,"item":39,"code":40,"title":41,"together":17},"cis","18","Control 18","Penetration Testing",{"family":43,"item":44,"code":45,"title":46,"together":17},"nis2","21-2-f","Article 21(2)(f)","Assessing the effectiveness of measures (Article 21(2)(f))",{"family":48,"item":49,"code":50,"title":51,"together":17},"nist-csf","gv-oc","GV.OC","Organizational Context"]