ISO/IEC 27036 Contract Security Clauses

The agreement should identify the parties, covered products and services, information and systems, locations, authorized access, security requirements, service measures, acceptance criteria, and the party responsible for each control. Attach a controlled schedule when detail will change more often than the main contract.

Address risks in both directions. The supplier may handle the acquirer's information or operate critical services; the acquirer may also access the supplier's sensitive production, assurance, or personnel information. Confidentiality, permitted use, access, evidence handling, and return or disposal terms should cover both.

Example clause design for remote maintenance: identify the systems that may be reached, authorized supplier roles, access approval and authentication, logging and review evidence, permitted support window, incident route, and access-removal trigger. The agreement should also state the response when evidence is missing or access falls outside those conditions. This is an example of translating risk treatment into measurable terms, not wording prescribed by ISO.

Start with the tender, supplier response, assessment, treatment plan, and selected exceptions. ISO/IEC 27036-2 requires the relationship agreement to address security requirements, implementation responsibilities, service or performance measures, reporting, communication, compliance monitoring and enforcement, change, and termination. Include only terms that fit the actual relationship, but do not leave a selected treatment as an informal promise.

Write measurable obligations. Replace phrases such as 'appropriate security' or 'prompt notice' with the applicable control, actor, scope, evidence, and contractually agreed timing. Derive any statutory deadline from the governing law; the ISO/IEC 27036 series does not set a universal incident-notification period.

Keep the approved risk treatment beside the executed agreement, schedules, incorporated policies, order forms, amendments, and exception approvals. A clause-to-risk record should show which obligation implements each selected treatment and who owns verification.

For each recurring obligation, record the evidence, period, covered entity and service, reviewer, result, limitation, and follow-up. Examples include access reviews, service reports, incident exercises, vulnerability or patch reports, independent assurance, continuity tests, and sub-supplier notices.

Preserve notices, waivers, breach or remediation correspondence, change decisions, and closure evidence. Without this history, a later reviewer cannot tell whether the parties used the enforcement and change mechanisms they agreed.

Use the agreement's change process when scope, access, data, location, ownership, technology, subcontracting, service measures, assurance, or law changes. A notice alone is not acceptance if the contract requires approval or gives the acquirer a right to object, require treatment, suspend use, or terminate.

At renewal, compare current operations with the contract and close undocumented side arrangements. At termination, apply the agreed transition, access removal, asset return, information return or disposal, retention, confidentiality, assistance, and verification terms.