ISO/IEC 27036 FAQ Fourth Parties

Start with the operational decision: define what Fourth Parties means in your ISO/IEC 27036 scope, who owns it, and what record proves the decision is current.

For supplier work, keep the supplier relationship type, tier, contract control, fourth-party exposure, monitoring cadence, incident notice route, and exit evidence in one record. This keeps the answer useful in audits, customer reviews, incidents, supplier reviews, and management review.

The evidence should show the process operating. For this artifact, the strongest record usually includes supplier tiering, due diligence, contract clauses, assurance reviews, fourth-party visibility, incident handoffs, monitoring records, and offboarding evidence.

Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, AI system, service, incident, risk, or control sample behind the answer.

In this context, suppliers are the direct parties you acquire from, while fourth parties are the downstream suppliers and supply chains behind those suppliers. NIST SP 800-161 describes cybersecurity risks throughout the supply chain as arising from suppliers, their supply chains, and their products or services, and it also notes that supplier contracts should flow down to sub-tier contractors.

That distinction matters because a direct supplier may look low risk while a sub-tier provider, shared component, or outsourced process creates the real exposure. Manage both the direct relationship and the downstream dependency in the same record.

Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, AI system, personal data flow, incident process, or customer commitment changes.

A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page.