Question:What action should an organization take to ensure the security of information when it is...

ISO/IEC 27002:2022 Clause 5.20 – Addressing information security within supplier agreements states:

“Agreements with suppliers should include requirements to address the information security risks associated with information and communications technology services and products provided by suppliers.”

Further emphasized in Clause 5.19 – Information security in supplier relationships, which mandates managing supplier-related risks.

This means contracts must include clauses addressing information security expectations, responsibilities, access rights, compliance, audits, and breach response mechanisms.