← ISO 27001 Annex A in plain English

A.5.21 A.5

Organizational / A.5.21

Managing risk across the technology supply chain

Think of it likeAsking the builder who else will be on site, and who they answer to.

In plain English

The family looks past its direct supplier to the people that supplier depends on, because a weakness anywhere in that chain still reaches the house.

Related CSF and CIS controls (unofficial mapping)