Back to all 93 controls
Annex A 5.20
Organizational
A.5.20 Addressing information security within supplier agreements
Contracts include security obligations.
What good looks like
Standard security and data-protection clauses in agreements with suppliers handling data or systems.
Evidence an auditor will ask for
Contract templates, signed addenda, DPAs.
Document template for this control
The Supplier Relationship Security Policy template gives you auditor-ready wording that fulfils Annex A 5.20. Preview the full document before you download the editable version.