Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
ISO 27001 puts supplier security in your ISMS. Coverbase helps you run it.
ISO/IEC 27001:2022 expects an information security management system that addresses supplier relationships, the ICT supply chain, and cloud services, covered by Annex A controls A.5.19 to A.5.23. Coverbase operates that supplier side so your supplier evidence is ready for a certification audit.
CoverbaseISO 27001 | supplier controls
ISO 27001 | supplier controls
A cloud service changes
Selected controls
Vendor evidence
New subservice
Agent work
01Map to ISMS
02Review the change
03Assign an owner
Control review prepared
Your ISMS owner resolves the exception.
What ISO/IEC 27001 is and who it's for
ISO/IEC 27001 is a voluntary international standard for an information security management system, published by ISO and IEC. Organizations can earn third-party certification from an accredited body. The current 2022 revision restructured Annex A into 93 controls and added 11 new controls, including A.5.23 on cloud-service security.
The supplier controls (Annex A.5.19 to A.5.23)
- 01
Security in supplier relationships (A.5.19)
Define and manage the information security risk of using suppliers. - 02
Security in supplier agreements (A.5.20)
Address security requirements in your supplier contracts. - 03
ICT supply-chain security (A.5.21)
Manage risk across the ICT products and services supply chain. - 04
Monitoring and cloud services (A.5.22 and A.5.23)
Review and monitor supplier services, and manage the security of cloud services you use.
Operate the supplier side of your ISMS
Auditors want to see supplier risk managed, not only documented. Coverbase keeps the diligence and monitoring running.
Supplier diligence, automated
Collect and review supplier security evidence on a schedule.Agreement terms tracked
Flag whether supplier contracts carry the security terms Annex A expects.Ongoing monitoring
Review and monitor supplier services over time.Cloud service inspection
With Coverbase Inspect, verify how a cloud service is configured.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
ISO/IEC 27001 supplier questions
Controls follow risk treatment and the ISMS scope.
Does every organization implement every Annex A control?
No. Your risk treatment and Statement of Applicability (SoA) determine which controls are relevant and why.
Is ISO/IEC 27001 a law?
No. It is an international ISMS standard, though a contract may require certification.
Does Coverbase issue ISO/IEC 27001 certification?
We help you run supplier reviews and keep evidence. An independent certification body assesses the ISMS in its defined scope.