ISO/IEC 27036 FAQ Contract Controls

Include controls selected from the relationship risk treatment and responsibilities, not a generic clause library. The supplier relationship agreement should make scope, performance, evidence, communication, exceptions, change, incident coordination, and exit reviewable by both parties.

ISO/IEC 27036-2 requires the agreement process to address information-security roles, controls across information, ICT, personnel, and physical security, transition, change, incidents, compliance monitoring and enforcement, and termination. The exact clauses still depend on the product or service, risk treatment, negotiation model, and applicable law.

A clause should say enough for both parties to act and for a reviewer to test performance. For incident reporting, define the trigger, contact path, required initial facts, update expectations, evidence preservation, investigation support, and any deadline supplied by law or contract. ISO/IEC 27036-2 requires an agreed incident-management procedure and immediate reporting within that procedure, but it does not supply a universal number of hours. For changes, define which service, location, ownership, control, subcontractor, or technology changes require notice or approval.

For assurance and enforcement, define the reports, attestations, self-assessments, independent assessments, audit access, correction process, and consequences that apply. For termination, define transfer or cancellation, asset inventory, access removal, return, retention or destruction, communication, transition support, and completion evidence.

A click-through, licence, public-cloud, or other standard-form agreement can still create a supplier relationship. If the supplier will not change its terms, compare the available commitment and evidence with the requirement, record each material gap, and decide whether configuration, architecture, reduced scope, insurance, monitoring, redundancy, or another compensating control brings risk within the organization's acceptance criteria.

If the remaining risk is outside those criteria, send the decision to the authorized risk owner. Do not label the relationship compliant merely because the terms are common in the market.