Skip to main content
All measures

Measure · ISO 27001 and other standards

Approve and follow through supplier services

Take an external service through selection, agreement, use and exit. Reuse existing supplier assessments and keep decisions and open work together in the existing procurement or service record.

Accountable: Internal service owner with procurement, the business department and ITReviewed

Reuse existing records

Reuse your supplier records, contracts and existing risk method. The assessment workbook helps when a suitable questionnaire is missing. The joint supplier and cloud policy sets the process without creating a second assessment or a mandatory form for every review.

What to do

  1. 1

    Define the service and appropriate checks

    Describe the purpose, information, access and consequences of failure in the existing record. Name the responsible person. Use your risk method and existing assessment to select the questions, evidence and checks needed. For a certificate, compare validity, scope and covered services with your use. Record open questions.

  2. 2

    Decide on terms and use

    Compare the required security services with the contract or proposed standard terms. Address protection, incident contacts and assistance, relevant subcontractors, changes, suitable evidence and the end of the service. For ICT products, also consider critical components, origin, integrity and support. Use suitable manufacturer information or risk-based checks. The authorised role decides on use and outstanding conditions. Internal approval does not override applicable obligations.

  3. 3

    Assign and carry out cloud tasks

    For the service actually used, record which tasks belong to the provider and which belong to you. Name internal owners for the remaining configuration, access, monitoring, backup, recovery and incident assistance. Check, for example, who creates backups and who tests that they can be restored. Carry out your tasks under your existing access and operating rules. Buying the service does not complete them.

  4. 4

    Carry out reviews, changes and exit

    In the same record, define who checks which agreed service and evidence, and when. Evaluate results and follow through corrections. Also review relevant changes, such as a new subcontractor, data location or end of support, to identify necessary changes to risk, contract and approval. At exit, prepare handover or export and the continued usability of required data. Carry out agreed deletion and the separate removal of access, then check the result. Record justified retention and outstanding evidence.

Worked example

Example: A cloud service changes its subcontractor

An approved cloud service announces a new subcontractor and a different processing location. The existing service record holds the assessment and contract.

Review the change
DecisionThe responsible person identifies the affected data and agreed terms. They assess the change with the relevant security and privacy roles.
EvidenceThe announcement, affected service and evaluated contractual or risk consequences are linked to the service record.
Decide on continued use
DecisionThe authorised role decides on continued use and necessary changes to safeguards or the contract. Open points receive an owner.
EvidenceThe decision refers to the evaluated change and the current agreement.
Follow through the result
DecisionThe responsible person checks whether the agreed changes were implemented. If continued use is unacceptable, they carry out the prepared export and exit with the provider and IT.
EvidenceThe review result and completed follow-up work remain in the existing record. A necessary exit is closed with the handover, end of access and deletion status.

Record the result

  • The existing supplier or service record connects the service, responsibility, assessment and reasoned use decision with the current agreement.
  • For cloud services, provider and customer tasks, their actual execution and suitable review results are traceable. Critical ICT dependencies and relevant subcontractors remain connected.
  • Ongoing reviews show evaluated results, changes and actual follow-up work. At the end of the service, handover, deletion and access status, and any outstanding retention or evidence, are traceable.

Common implementation mistakes

Treating a certificate as approval

Check whether it covers the purchased service and your use. Resolve remaining risks and open conditions before the authorised role decides on use.

Confusing provider tasks with your own tasks

A provider backup does not tell you who can restore your data, or in what form. Clarify the specific split and check your remaining tasks.

Creating a new list for every review

Keep results and follow-up work in the existing service record. A new register or an on-site audit for every supplier is not a universal requirement.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

Templates for your implementation

Related resources

Sources and further reading