Why the supplier register is the part of ISO 27001 that goes stale first

Every ISO 27001 project has a moment where someone opens the supplier register and goes quiet. It was accurate the week it was written. Then marketing bought a webinar tool, engineering connected two AI APIs, and someone in sales expensed a data enrichment service nobody told IT about. The register in the Notion database says 117 tools. The card statements say otherwise.

We see this on calls all the time. A finance lead keeping a vendor list by hand for an audit in November. An IT manager who found "a lot of subscriptions we didn't know about" on the way to certification. The list itself is never the hard part. Keeping it true is, because software gets bought across the whole company and the register lives in one person's spreadsheet.

This post is about running ISO 27001 vendor management in Cledara, where the list of software vendors is built from what you actually pay for, and the questionnaire, evidence and access review sit on the same record as the subscription.

Key takeaways

Cledara data shows the median company on the platform paid 32 software vendors in the year to October 2026, and a quarter paid 48 or more. That is the size of the supplier register an auditor expects you to keep current.
The Software Compliance module adds a questionnaire to every software request, with templates for the business case, product details, risk assessment, contract review and exit plan, and lets you delegate sections to colleagues and to the vendor.
Evidence is attached to the application record and the whole questionnaire exports as a PDF, or a ZIP with attachments, for the auditor.
Vendors carry ISO 27001 and SOC 2 certification tags, so the first question in every review is already answered.
Access reviews come from the same list: who has access to each tool, with Cledara Agent removing leavers after a single approval.
ISO 27001 vendor management stays accurate in Cledara because the register is built from payments and usage rather than memory.

What ISO 27001 actually asks about your software vendors

ISO 27001 doesn't ask your vendors to be certified. It asks you to know who they are and to manage the risk of using them. In the 2022 version of the standard the supplier controls sit in Annex A under 5.19 to 5.23: a policy for information security in supplier relationships, security requirements in supplier agreements, managing the ICT supply chain, monitoring and reviewing supplier services, and the security of cloud services.

In plain words, an auditor wants to see four things for each software vendor that touches your data. That you knew you were using it. That someone assessed the risk before or soon after you started. That the contract covers security, data and exit. And that you review it when something changes, including when you stop using it and need the data back.

For a 30-person company that is a manageable afternoon. For a company paying 48 vendors, with new ones arriving every month, it is a process, and the process has to live somewhere that updates itself. That's the gap the Software Compliance module fills.

How ISO 27001 vendor management maps to Cledara

The short version: the subscription is the record. Every tool you pay for through Cledara is already in the list with an owner, a renewal date, a cost and a card. The compliance module hangs the questionnaire, the evidence and the certification tags off that same record, so the vendor register and the spend register are the same list.

What the auditor asks	Where it lives in Cledara
Which suppliers process our information?	The application list, built from every payment plus the tools you add, with Cledara Engage showing unapproved tools in use
Did you assess the risk before using them?	The compliance questionnaire, triggered when a new application is requested, with a risk assessment section
Does the contract cover security and exit?	The contract review and exit plan sections, with the contract and evidence attached to the application
Is the supplier certified?	ISO 27001 and SOC 2 certification tags on the vendor
Who has access, and did leavers lose it?	One list of who has access to each tool, with Cledara Agent removing leavers after one approval
Show me the evidence	Export the questionnaire as a PDF, or a ZIP with the PDF and every attachment

How to set up ISO 27001 vendor management in Cledara

This is the order that works, from customers who went through certification with it running.

Switch on the Software Compliance module. It's available on every plan as an add-on (the pricing page has the details).
Decide whether the questionnaire is mandatory when someone requests a new application, or optional with a reminder for later. Most companies going through certification make it mandatory for anything that touches customer data and optional for the rest.
Customise the templates. The five sections are the business case, details of the product or service, risk assessment, contract review and exit plan. The exit plan only appears when the risk assessment marks a tool as critical or important, which keeps the form short for the long tail.
Set who can answer. Admins, team managers, and compliance and finance users can complete sections at any time from the Compliance tab, and application owners can be given permission too. Each section shows as pending, in progress or completed.
Delegate what you can't answer. Sections can go to the colleague who knows the tool, or to the vendor for the security questions. Nobody in finance should be guessing where a vendor hosts its data.
Attach the evidence. Contracts, data processing agreements and certificates go on the application record as PDF or image files, so the proof lives next to the answer.
Check the certification tags. Every vendor shows whether it holds ISO 27001 or SOC 2, so you can see at a glance which reviews will be quick and which need a closer look.
Export for the auditor. From the questionnaire overview, download a PDF without attachments or a ZIP with the PDF and every file. One export per tool, in the same format, which is what auditors like most.

Tip: run the questionnaire against your ten biggest tools first. They hold most of your data, they take longest, and finishing them early makes the rest of the register feel like admin rather than a project.

ISO 27001 vendor management includes the access review

The other half of supplier security is people. An auditor will ask who has access to each system and what happens when someone leaves, and the honest answer in most companies is "the owner of each tool, if they remember". Cledara keeps one list of who has access to each tool, which is what the access review needs. When someone leaves, Cledara Agent lists everything they had and removes them after a single approval, so the leaver review is a record rather than a hunt.

Shadow IT fits here too. Peter Fallowfield, IT Manager at Solidatus, said it plainly: "We had a lot of subscriptions we didn't know about and we had to lock that down to get our ISO27001 certification." Cledara Engage, the browser extension, shows which of 8,000+ tools the team actually uses, including the ones nobody approved, and collects only a username and a timestamp to do it. Those tools then go through the same questionnaire as everything else.

Jenny Liu, Head of Finance at Marshmallow, described the knock-on effect: "Cledara's compliance module prompted us to think about how to evaluate the IT risk of all our tools." That is the point. The module doesn't make you compliant; it makes the right questions unavoidable at the moment a tool arrives.

Keeping ISO 27001 vendor management alive after the certificate

Certification is the easy bit. Surveillance audits come round every year, and the register that was perfect in November is wrong by March unless the process runs itself. A few habits that keep it true:

Treat every new application request as a compliance event. If the questionnaire is part of the request, the register updates itself as the company buys.
Use renewals as review dates. Every renewal in Cledara has an alert; make the renewal the moment someone confirms the risk assessment still holds.
Review the unapproved tools list monthly. Anything that turns up in Engage is either approved and assessed, or cancelled with a click.
Keep the exit plan honest. When a tool is cancelled, the exit plan section says where the data was and who confirmed it was deleted.
Export once a quarter, even when nobody asks. The auditor's request stops being an event.

There's a longer piece on why managing your software subscriptions well makes ISO 27001 easier, if you're earlier in the journey.

Where ISO 27001 vendor management is going

I think compliance is about to change in the same way bookkeeping did. For years the register was a document someone maintained, and audits were a scramble to make the document match reality. Now the register can be the reality: built from what you pay for, updated by what people use, with the evidence attached where the money is. The auditor still asks the same questions. The answers just already exist.

The companies that do this well won't have a bigger compliance team. They'll have a finance team and an IT team working off one list, a questionnaire that fills itself in as the company grows, and a certificate that stops feeling like a project every year. That is a better way to run a company, and it's the one we're building for.

Frequently asked questions

What does ISO 27001 require for software vendor management?

ISO 27001:2022 covers supplier relationships in Annex A controls 5.19 to 5.23: a policy for information security in supplier relationships, security requirements in supplier agreements, managing the ICT supply chain, monitoring and reviewing supplier services, and security for cloud services. In practice an auditor wants to see that you know which vendors process your information, assessed the risk, covered security and exit in the contract, and review access and changes.

How does Cledara help with ISO 27001 vendor management?

Cledara builds the vendor register from what you actually pay for, then the Software Compliance module adds a questionnaire to each software request covering the business case, product details, risk assessment, contract review and exit plan. Evidence attaches to the application record, vendors carry ISO 27001 and SOC 2 certification tags, and the questionnaire exports as a PDF or ZIP for the auditor.

Can compliance questionnaires be delegated to the vendor?

Yes. Sections of the questionnaire can be delegated to internal colleagues who know the tool and to the external vendor for the security questions. Admins, team managers, and compliance and finance users can complete sections from the Compliance tab, and application owners can be given permission to answer too.

How many software vendors does a typical company need to keep in its supplier register?

Cledara data shows the median company on the platform paid 32 software vendors in the year to October 2026, with a quarter of companies paying 48 or more. The number grows as teams adopt AI tools, which is why a register kept by hand in a spreadsheet or Notion database goes out of date within weeks.

Does Cledara cover ISO 27001 access reviews?

Cledara keeps one list of who has access to each tool, which is what an access review needs. When someone leaves, Cledara Agent lists everything they had and removes them after a single approval, and Cledara Engage shows which tools people are using, including ones that were never approved, so they can be assessed or cancelled.

Is Cledara itself ISO 27001 certified?

Cledara is SOC 2 Type II certified and GDPR compliant, hosted on Amazon Web Services with regular penetration testing. The Software Compliance module is built to help customers manage their own ISO 27001 and SOC 2 requirements for the software vendors they use.