Policy Register
Every policy type · Suppliers and third parties

Service level management policy

How supplier service levels are set, measured, reviewed and acted on, and how changes to a service are handled.

How the register reads it

Also calledSLA management, service review
FamilySuppliers and third parties
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the supplier and third-party security policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerProcurement or the vendor manager, with the information security lead.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, supplier and third-party security policy, is).
TemplateService level agreement management policy.

Which standards require it, and what each expects it to contain

1 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.22 Monitoring, review and change management of supplier services

Regularly monitor, review and manage change in supplier security practice and service delivery.

What the ISO 27002 guidance expects the document to say: Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regular basis, and requires change within them to be managed.

Evidence an auditor accepts: The schedule of supplier reviews, showing frequency by tier and evidence the schedule was met; service reports and security metrics received from suppliers, and the review of them; records of issues raised with suppliers, and their resolution or escalation
Common gap: relying on informal verbal updates
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Outsourcing policy · Supplier and third-party security policy