is the four-part international standards series for information security in supplier relationships. Start with the relationship: who acquires and supplies what, which information or systems are exposed, how dependent the parties are, and which direct or indirect suppliers affect delivery. Then select the relevant part of the series and preserve the resulting decision and evidence.
Browse sub-FAQs
Choose the question set you need
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
Part 1:2021 provides overview and concepts; Part 2:2022 specifies fundamental requirements for supplier and acquirer relationships; Part 3:2023 guides hardware, software, and services supply-chain security; and Part 4:2016 guides cloud service customers and providers. ISO lists all four editions as published; Part 4 was confirmed in 2022, while Part 1 entered systematic review on 15 July 2026.
Use the series throughout the relationship life cycle and alongside the organization's risk management, procurement, security, operational, and human-resources processes. Identify legal, regulatory, customer, and contract duties separately; the series is not legislation.
Part 2 applies to procurement and supply of products and services across organizations of any type, size, or nature, including manufacturing, business processes, software, hardware, and cloud services.
An acquirer procures a product or service; a supplier agrees to provide it. The parties can belong to the same organization, and one organization can be an acquirer in one relationship and a supplier in another.
The series does not establish a standalone certification scheme. ISO/IEC 27001 certification or other assurance can inform a supplier decision only within its actual scope.
Official page for Part 4 cloud-service guidance, which ISO says was reviewed and confirmed in 2022 and remains current.
2
Question 2
What implementation sequence should teams follow?
Define the product or service, parties, information, systems, locations, access, dependencies, criticality, and applicable duties. Assess inherent risk, set the acceptable level, choose treatment, and document management's decision before procurement proceeds.
Then select the supplier against stated security criteria, agree roles and controls, define evidence and acceptance, manage transition, monitor performance and change, coordinate incidents and corrective actions, and execute renewal or termination from a pre-agreed plan.
Selection and agreement: supplier evidence, audit and assurance terms, subcontractors, service measures, change, incidents, enforcement, transition, and termination.
Management and exit: scheduled and event-driven review, findings and corrective actions, agreement updates, asset and access control, transfer or cancellation, and verified closure.
Part 3 adds life-cycle guidance for multi-layer hardware, software, and service dependencies, including visibility, evidence, vulnerabilities, verification, and disposal.
Which part should be used for a specific decision?
Use Part 1 to understand terms, roles, relationship types, supply chains, cloud context, and the structure of the series. Use Part 2 for the fundamental requirements that govern an individual supplier relationship and the organizational processes supporting it. Add Part 3 when hardware, software, services, components, provenance, vulnerabilities, or multi-layer supply-chain risk matter. Add Part 4 for cloud customer-provider risks and responsibilities.
Part 3 and Part 4 both exclude business-continuity management or resiliency from their specific scope and point to ISO/IEC 27031 for ICT readiness for continuity. The supplier agreement and applicable obligations can still contain continuity and recovery requirements.
Before procurement, use the risk-tier FAQ to scale the assessment and the contract-controls FAQ to translate treatment into reviewable commitments.
During operation, use the assurance-evidence, supplier-monitoring, supplier-incidents, cloud-suppliers, and fourth-parties FAQs for the relevant decision.
Before renewal or exit, use the termination-and-offboarding FAQ to verify transfer, access removal, asset handling, retained duties, and closure evidence.
Part 4 covers cloud supplier-relationship guidance, remains current after 2022 confirmation, and excludes cloud business-continuity management or resiliency from its scope.
4
Question 4
Questions and answers
Is a certifiable standard?
The series does not establish a standalone certification scheme. Evidence from a certified ISO/IEC 27001 ISMS or another assurance source may support a supplier decision only within its actual scope.
Does apply only to ICT suppliers?
No. Part 1 describes supplier relationships with information-security implications broadly; Part 3 focuses specifically on ICT supply chains and Part 4 on cloud services.
What is the difference between an acquirer and a supplier?
An acquirer obtains a product or service; a supplier enters an agreement to provide it. The parties may be within the same organization, and one organization can hold both roles in different supply-chain relationships.
Does prescribe fixed risk tiers or review intervals?
No fixed tier model or universal supplier-monitoring cadence is prescribed. Part 2 separately requires the supplier relationship strategy and acquirer relationship strategy to be reviewed at least annually and after significant business, legal, regulatory, architectural, policy, or contractual changes. The acquirer must also review its strategy when a product or service being procured can significantly affect it; the supplier must review its strategy when establishing a relationship that can significantly affect it. Part 2 also requires the risk assessment to be commensurate with product or service criticality. Organizations should define their own criteria, resulting controls, evidence depth, scheduled reviews, event triggers, approvers, and exception process.
What evidence should be retained?
Retain the scoped relationship, risk assessment and treatment, management decision, selection evidence, agreement and amendments, acceptance, assurance and operating evidence, incidents, changes, findings, corrective actions, access and asset records, and termination evidence that apply. Each record should identify the product or service, period, reviewer, decision, owner, limitations, approval, and next trigger.
Does an ISO/IEC 27001 certificate prove that a supplier meets ?
No. An ISO/IEC 27001 certificate can support a supplier decision, but it covers only the named organization, ISMS scope, sites, activities, standard edition, and validity period. Compare that scope with the product or service, systems, locations, subcontractors, and requirements in the relationship. Record uncovered requirements as not verified instead of treating the certificate as proof of conformity.
How does address subcontractors and fourth parties?
-2:2022 makes subcontractor transparency a supplier-selection consideration, including use, access to acquirer information, personnel, changes, assurance, audit, and confidentiality. ISO/IEC 27036-1 and Part 3 describe successive supplier relationships and limited upstream visibility; they do not prescribe a universal fourth-party register. Define proportionate notice, approval, flow-down, evidence, incident, change, and exit terms with the direct supplier.
When should a supplier risk assessment be repeated?
Repeat the assessment at the organization's planned risk-based interval and when a significant change can invalidate the accepted risk. -2 examples include changes to business or mission, financial strength, ownership, service location, security level, continuity capability, or legal, regulatory, and contractual requirements. Incidents, failed measures, new subcontractors, architecture changes, assurance loss, renewal, and planned termination are also practical event triggers when they affect the relationship.
Does set incident-notification deadlines?
-2:2022 requires an agreed procedure so incidents in scope are identified, immediately reported, and investigated with legal, regulatory, and contractual requirements considered. It does not convert "immediately" into one universal number of hours or days. The applicable law and agreement should define any fixed deadline, recipients, content, escalation, cooperation, evidence preservation, and follow-up.
Which part applies to cloud services?
Use -2:2022 for the supplier and acquirer relationship requirements and add ISO/IEC 27036-4:2016 for cloud customer-provider risks and responsibilities. Add Part 3 when the cloud service also depends on material hardware, software, infrastructure, build, update, or support layers. Part 4 remains current after ISO confirmed it in 2022, but it does not explain how a provider should operate all security controls; ISO points to ISO/IEC 27002 and ISO/IEC 27017 for that guidance.
Does cover business continuity and resilience?
Part 2 includes continuity capability, transition, termination, and related agreement considerations for the supplier relationship. Parts 3 and 4 expressly exclude business-continuity management or resiliency from their specific guidance scopes and point to ISO/IEC 27031 for ICT readiness. Contracts, laws, risk treatment, and other standards can still require recovery objectives, continuity tests, alternative supply, and exit arrangements.
What should happen when supplier evidence is missing or fails a criterion?
Treat missing, stale, out-of-scope, inconsistent, or failed evidence as a finding. Identify what remains unverified, assess the affected requirement and risk, set any interim protection, agree a corrective action and time scale, and decide whether the agreement or risk treatment must change. Close the finding only when the acceptance condition is met or an authorized risk owner records another approved outcome, such as restricted use or time-limited residual-risk acceptance.
Official ISO catalogue entry for ICT supply-chain guidance.
Official current-edition page for Part 3 hardware, software, and services supply-chain guidance.
Part 3 adds life-cycle guidance for multi-layer hardware, software, and service dependencies, including visibility, evidence, vulnerabilities, verification, and disposal.
Show 1 more
Part 3 covers hardware, software, and services supply-chain guidance and excludes business-continuity management or resiliency from its scope.
Official ISO catalogue entry for cloud-service guidance; confirmed in 2022.
Official page for Part 4 cloud-service guidance, which ISO says was reviewed and confirmed in 2022 and remains current.
Part 4 adds cloud customer-provider guidance for shared responsibilities, assurance, changes, incidents, asset transfer, and disposal.
Show 1 more
Part 4 covers cloud supplier-relationship guidance, remains current after 2022 confirmation, and excludes cloud business-continuity management or resiliency from its scope.