iso.org
Referenced sections
- Official ISO listing and abstract for the Part 1:2021 overview, concepts, and acquirer and supplier perspectives.
"overview of the guidance intended to assist organizations"
By Sorena AIPublished Updated
ISO/IEC 27036
ISO/IEC 27036
Plain-language ISO/IEC 27036 guide to supplier relationships, ICT supply chains, cloud services, agreements, monitoring, and evidence.
- Part 1: concepts
- Part 2: requirements
- Part 3: supply chain
- Part 4: cloud services
Understand ISO/IEC 27036
Use ISO/IEC 27036 to manage information-security risk that arises when an depends on a supplier for a product or service, including and cloud services.
Use Part 1:2021 for concepts, Part 2:2022 for requirements, Part 3:2023 for hardware, software, and services supply-chain guidance, and Part 4:2016 for cloud-service guidance. Part 2 applies to procurement and supply relationships in organizations of any type or size. The series is not a law or a standalone certification scheme; apply it with your ISMS, contracts, risk criteria, and legal duties.
Define the relationship and risks to both parties, select the relevant requirements and guidance, agree responsibilities and evidence, then keep the decision current through operation, change, and termination.
Quick scan
Relationship types
Map both parties, the supplied product or service, access, business dependence, and upstream or downstream relationships.
Contract and assurance
Use Part 2 requirements and risk treatment to define responsibilities, controls, assurance, change, incident, continuity, and exit terms.
Lifecycle governance
Retain approvals, due diligence, agreement versions, operating measures, reviews, incidents, changes, exceptions, and termination evidence.
Implementation decisions
- 1
Relationship types
Identify the , supplier, product or service, information access, locations, business dependence, and upstream relationships. Procurement need not involve payment, and one organization can be an acquirer upstream and a supplier downstream.
- 2
Contract and assurance
Translate approved risk treatment into measurable agreement terms for responsibilities, access, assurance, change, incidents, subcontractors, continuity, and exit. Record any rejected term and the residual-risk decision.
- 3
Lifecycle governance
Manage the Part 2 lifecycle from planning and supplier selection through agreement, operation, change, renewal, and termination. Reassess periodically and after significant business, legal, regulatory, architectural, policy, or contractual change.
Move from relationship scope to lifecycle evidence
Start by identifying the parties, covered product or service, information and system access, locations, and dependencies. Assess risks to both parties, turn treatment into agreements and controls, monitor delivery and change, and close the relationship with verified exit evidence.
Start here: series, scope, and roles
Understand what each current part covers, how and supplier roles work, and which product, service, cloud, or multi-layer supply-chain conditions apply.
Assess risk and agree controls
Assess the relationship using your risk criteria, investigate material direct and indirect dependencies, and put selected security treatments into measurable, reviewable agreement terms.
Operate the supplier lifecycle
Connect planning, selection, agreement, management, and termination to named owners, operating evidence, reassessment triggers, and verified closure.
Compare complementary approaches
Use the comparison to decide how ISO/IEC 27036 relationship practices and NIST cyber supply-chain risk management can share evidence without treating either as automatic conformity with the other.
Sources
iso.org
Referenced sections
- Official ISO listing and abstract for Part 2:2022, including its scope across procurement and supply and its fundamental relationship requirements.
"fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships"
iso.org
Referenced sections
- Official ISO listing and abstract for Part 3:2023 guidance on multi-layer hardware, software, and service supply-chain visibility, risk response, and lifecycle integration.
"multi-layered hardware, software, and services supply chains"
iso.org
Referenced sections
- Official ISO listing for Part 4:2016 cloud-service customer and provider guidance; ISO records the edition as published and confirmed in 2022.
"Guidelines for security of cloud services"
Next steps
Manage supplier controls and evidence
Assign supplier assessments, agreement controls, evidence requests, and review checkpoints to the responsible people.
- Start from the ISO/IEC 27036 page that matches the decision or evidence gap.
- Use Research Copilot for interpretation questions tied to cited sources.
- Keep evidence, owners, and review history together in SSOT.
- Open Research Copilot
Answer ISO/IEC 27036 scope and interpretation questions with cited outputs.
- Open SSOT
Keep ISO/IEC 27036 evidence, decisions, and control records in one governed system.
- Talk through implementation
Review scope, evidence gaps, and next implementation steps.