ISO/IEC 27036 Using the Series

Start with Part 2 when the organization needs requirements for defining, implementing, operating, monitoring, reviewing, maintaining, or improving supplier and acquirer relationships. Part 1 explains the vocabulary and relationship types. Part 3 adds guidance for physically dispersed, multi-layer hardware, software, and service supply chains. Part 4 adds guidance for cloud service customers and providers.

Part 2 covers procurement and supply of products and services, including manufacturing, business processes, software and hardware components, build-operate-transfer arrangements, and cloud services. Its requirements address both acquirer and supplier perspectives; a supplier assessment that records only the acquirer's risks is incomplete.

Example: a software-as-a-service purchase uses Part 2 for the relationship requirements, Part 3 when upstream software, infrastructure, build, update, or support dependencies affect risk, and Part 4 for cloud customer-provider responsibilities. Using Part 3 or Part 4 does not replace Part 2 or make every recommendation mandatory; record which provisions the organization selected and why.

ISO/IEC 27036-2 expects the organization to have, or to plan, foundational business, risk, operational, human-resources, and information-security processes. Apply its supplier-relationship requirements through those processes rather than treating the standard as a stand-alone questionnaire.

ISO/IEC 27001 contains certifiable ISMS requirements, while ISO/IEC 27002 provides control guidance. ISO/IEC 27036 adds supplier-relationship detail. An ISO/IEC 27001 certificate can be one supplier-selection input, but its scope, covered locations, services, exclusions, and validity still need review.

The relationship lifecycle in Part 2 runs through planning, supplier selection, agreement, management, and termination. Risk must be reconsidered periodically and when significant business, legal, regulatory, architectural, policy, or contractual changes occur.

Evidence should follow the decision. For planning, retain the relationship scope, risk assessment and treatment plan, legal or regulatory review, approvals, and selection criteria. For selection and agreement, retain due diligence, tender and response records, assurance limits, accepted exceptions, and the signed agreement.

During operation, retain service and security measures, access reviews, incident and change records, assurance results, corrective actions, and reassessments. At termination, retain transition decisions, access removal, asset return, information return or disposal, surviving retention duties, and closure approval.

A certificate, policy, or audit report is supporting evidence only. Record its issuer, scope, period, covered entity and service, qualifications, reviewer conclusion, and any gap that remains for the specific relationship.

Set a planned review interval from the relationship's risk and contract, then add event-driven review. Part 2 calls for periodic re-examination and review when significant business, legal, regulatory, architectural, policy, or contractual changes occur.

Reopen the assessment when the service, information, access, location, ownership, subcontracting, technology, threat exposure, control performance, or business dependence changes. An incident or missed service measure may require correction without changing the contract, while a changed responsibility or risk allocation may require an amendment.

Termination is a controlled lifecycle process. Coordinate continuity and transition, remove access, recover assets, return or dispose of information subject to retention duties, preserve required records, and record unresolved obligations before closure.