ISO/IEC 27036 FAQ Assurance Evidence

ISO/IEC 27036-2:2022 sets requirements for acquirers and suppliers across the relationship lifecycle. It identifies several forms of assurance, including performance reports, attestations, self-assessments, independent assessments, audits, tested continuity plans, and ISO/IEC 27001 certification. Part 3:2023 adds hardware, software, and service supply-chain guidance. The acquirer must decide what evidence is credible and sufficient for the selected supplier and requirement.

Use a certificate to confirm only the certified management-system scope and period. Use an independent audit or attestation report for the controls, system boundary, period, exceptions, and complementary responsibilities it actually covers. Use questionnaires and interviews to fill relationship-specific gaps, but verify consequential answers with records, demonstrations, tests, or other independent evidence when the risk warrants it.

Product evidence can differ from organization-level evidence. For hardware, software, and services, relevant evidence may include test results, vulnerability and remediation records, chain-of-custody records, provenance information, a software bill of materials, delivery verification, or proof that required security features work. A software bill of materials helps identify components and relationships, but it does not prove that the listed components are vulnerability-free or securely configured.

Retain the relationship and requirement being assessed, the evidence requested and received, its scope and period, the reviewer, the conclusion against stated acceptance criteria, open findings, corrective-action owner and due date, residual-risk decision, approval, and next review or event trigger.

Reassess when evidence expires or the service, product, location, ownership, subcontracting, threat exposure, agreement, or intended use changes. An incident or material control failure can require an earlier review.