Supplier Review Register Template for ISO 27001 (Free Excel)

Supplier Review Register Template

Criticality ratings, DPA tracking, automatic review dates · Excel (.xlsx) · Free, no email required

What's in the template

A supplier security register covering what each supplier does, what data it touches, its criticality, contracts and DPAs, certifications, and a review schedule with automatically calculated next-review dates. Two worked examples show the expected detail.

How to use it

List every supplier that touches your information or that your service depends on. Finance's supplier ledger is a good starting checklist.
Rate criticality by the impact of the supplier failing or being breached, and record whether contracts and DPAs are actually in place.
Set a review frequency; the next review date calculates automatically from the last review.
Feed material supplier risks into your risk register, and evidence completed reviews for controls 5.19–5.22.

Distinguish suppliers from sub-processors: this register covers all suppliers relevant to security. If you process personal data for your own customers, the subset that processes it on your behalf also belongs on a published sub-processor list, like ours.

Frequently asked questions

Why does ISO 27001 require a supplier register?

Annex A controls 5.19 to 5.22 require you to manage information security in supplier relationships. A register is how businesses evidence knowing their suppliers, what data they touch, what agreements exist and that reviews happen.

Which suppliers belong on the register?

Any supplier that accesses, processes or stores your information, and any whose failure would disrupt your service: hosting, SaaS tools, IT support, payroll.

How often should suppliers be reviewed?

Risk-based: critical and high-criticality suppliers at least annually, others on a two-year cycle. The template calculates next review dates automatically.

Supplier review register