ISO/IEC 27036 FAQ

Part 1:2021 provides overview and concepts; Part 2:2022 specifies fundamental requirements for supplier and acquirer relationships; Part 3:2023 guides hardware, software, and services supply-chain security; and Part 4:2016 guides cloud service customers and providers. ISO lists all four editions as published; Part 4 was confirmed in 2022, while Part 1 entered systematic review on 15 July 2026.

Use the series throughout the relationship life cycle and alongside the organization's risk management, procurement, security, operational, and human-resources processes. Identify legal, regulatory, customer, and contract duties separately; the ISO/IEC 27036 series is not legislation.

Define the product or service, parties, information, systems, locations, access, dependencies, criticality, and applicable duties. Assess inherent risk, set the acceptable level, choose treatment, and document management's decision before procurement proceeds.

Then select the supplier against stated security criteria, agree roles and controls, define evidence and acceptance, manage transition, monitor performance and change, coordinate incidents and corrective actions, and execute renewal or termination from a pre-agreed plan.

Use Part 1 to understand terms, roles, relationship types, supply chains, cloud context, and the structure of the series. Use Part 2 for the fundamental requirements that govern an individual supplier relationship and the organizational processes supporting it. Add Part 3 when hardware, software, services, components, provenance, vulnerabilities, or multi-layer supply-chain risk matter. Add Part 4 for cloud customer-provider risks and responsibilities.

Part 3 and Part 4 both exclude business-continuity management or resiliency from their specific scope and point to ISO/IEC 27031 for ICT readiness for continuity. The supplier agreement and applicable obligations can still contain continuity and recovery requirements.