Turn supplier-risk treatment into agreement terms that both acquirer and supplier can operate, measure, review, and enforce.
Use Part 2 for supplier and acquirer relationship requirements and Parts 1, 3, and 4 for concepts or guidance. The series is voluntary; assess contracts, law, customer commitments, and certification scopes separately.
Structured answer sets in this page tree.
Cited legal and guidance references.
Draft each from the approved relationship scope and risk treatment. State who must do what, for which product or service, by when, to what measure, with what evidence, and what happens after failure, change, or termination. This is a clause-content checklist, not official ISO wording or a substitute for jurisdiction-specific legal review.
The agreement should identify the parties, covered products and services, information and systems, locations, authorized access, security requirements, service measures, acceptance criteria, and the party responsible for each control. Attach a controlled schedule when detail will change more often than the main contract.
Address risks in both directions. The supplier may handle the acquirer's information or operate critical services; the acquirer may also access the supplier's sensitive production, assurance, or personnel information. Confidentiality, permitted use, access, evidence handling, and return or disposal terms should cover both.
Example clause design for remote maintenance: identify the systems that may be reached, authorized supplier roles, access approval and authentication, logging and review evidence, permitted support window, incident route, and access-removal trigger. The agreement should also state the response when evidence is missing or access falls outside those conditions. This is an example of translating risk treatment into measurable terms, not wording prescribed by ISO.
Start with the tender, supplier response, assessment, treatment plan, and selected exceptions. ISO/IEC 27036-2 requires the relationship agreement to address security requirements, implementation responsibilities, service or performance measures, reporting, communication, compliance monitoring and enforcement, change, and termination. Include only terms that fit the actual relationship, but do not leave a selected treatment as an informal promise.
Write measurable obligations. Replace phrases such as 'appropriate security' or 'prompt notice' with the applicable control, actor, scope, evidence, and contractually agreed timing. Derive any statutory deadline from the governing law; the ISO/IEC 27036 series does not set a universal incident-notification period.
Keep the approved risk treatment beside the executed agreement, schedules, incorporated policies, order forms, amendments, and exception approvals. A clause-to-risk record should show which obligation implements each selected treatment and who owns verification.
For each recurring obligation, record the evidence, period, covered entity and service, reviewer, result, limitation, and follow-up. Examples include access reviews, service reports, incident exercises, vulnerability or patch reports, independent assurance, continuity tests, and sub-supplier notices.
Preserve notices, waivers, breach or remediation correspondence, change decisions, and closure evidence. Without this history, a later reviewer cannot tell whether the parties used the enforcement and change mechanisms they agreed.
Capture owners, evidence, decisions, and review dates in one workflow record so supplier security controls and escalation points stay auditable over time.
Convert ISO/IEC 27036 Contract Security Clauses into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Use the agreement's change process when scope, access, data, location, ownership, technology, subcontracting, service measures, assurance, or law changes. A notice alone is not acceptance if the contract requires approval or gives the acquirer a right to object, require treatment, suspend use, or terminate.
At renewal, compare current operations with the contract and close undocumented side arrangements. At termination, apply the agreed transition, access removal, asset return, information return or disposal, retention, confidentiality, assistance, and verification terms.