Search every question across sub-FAQs

Agree incident contacts, triggers, information sharing, investigation support, evidence preservation, containment and recovery coordination, corrective action, and review before an information security incident occurs. ISO/IEC 27036 does not set one universal notification deadline; applicable law, regulation, policy, or contract supplies mandatory timing.

ISO/IEC 27036-2:2022 requires the supplier agreement to contain an incident-management procedure and requires both parties to follow the agreed procedure. The standard calls for immediate reporting within that procedure, but the parties and applicable authorities still determine the reportable trigger, recipient, clock, and required content. Part 3:2023 adds supply-chain concerns, including sharing incident information upstream and downstream, responding to vulnerabilities, and examining whether the underlying weakness also affects other components or services.

The first notice should identify what happened or is suspected, when it was detected, the affected service or product, known time window and scope, current operational and information-security impact, containment already taken, whether an upstream supplier is involved, actions the acquirer should take, and the next update time. Mark unknown facts as unknown rather than delaying all notice for a complete investigation.

The contract or incident procedure should say how the supplier protects sensitive investigation material while still giving the acquirer enough information to assess impact and meet its own duties. Where law imposes a deadline or content requirement, record that source separately and make the contractual process capable of supporting it.

Track eradication, recovery, affected-version or service status, corrective actions, owners, due dates, and evidence of completion. Reassess the relationship risk, supplier controls, upstream dependencies, monitoring, assurance, agreement terms, and any downstream commitment the acquirer has made to customers or authorities.

Close the incident only when the agreed closure criteria are met or an authorized owner accepts the remaining actions and risk. Preserve a record of the incident and related decisions for the period required by the agreement, policy, and applicable law.

ISO/IEC 27036 does not prescribe one universal monitoring interval. Set scheduled and event-driven reviews according to risk, agreement terms, service criticality, evidence availability, and the speed at which the relationship can change.

ISO/IEC 27036-2:2022 requires the acquirer to define monitoring activities, their frequency, reporting, and corrective-action follow-up in the agreement, while the supplier supports those activities and operates its corrective-action process. Both parties reassess relevant changes and preserve the resulting records. The monitoring plan should state what is checked, who checks it, which evidence is accepted, when review occurs, and what triggers escalation after a nonconformity.

A review should decide whether the supplier and acquirer are meeting the agreement, whether the evidence covers the actual product or service and review period, whether risk has changed, and whether any finding needs correction, a control change, an agreement update, formal acceptance, or termination planning.

Do not equate receipt with review. Record the requirement tested, evidence and period, reviewer, result, limitation, finding severity, corrective-action owner and due date, approval, and next scheduled or event-driven review.

Trigger an early review after an incident, material vulnerability, missed service or security measure, expired or qualified assurance, major corrective-action delay, service or architecture change, new data use, access expansion, location change, merger or financial distress, new or changed subcontractor, end-of-support notice, regulatory change, or failed recovery or exit test.

The trigger should route to a named owner who can assess scope and risk, request evidence, update controls or terms, approve a time-bound exception, or begin replacement or termination. A calendar date alone does not handle fast-changing relationships.

Create a termination plan before the relationship starts. Coordinate continuity and transition, revoke physical and logical access, rotate shared secrets, disable integrations, recover assets, return or delete information subject to retention duties, preserve required records, and verify surviving obligations.

ISO/IEC 27036-2:2022 requires the supplier relationship agreement to contain a termination process and plan. At termination, the parties decide whether supply is cancelled, returned to the acquirer, or transferred to another supplier; maintain an asset inventory; agree asset return, transfer, destruction, or retention; remove access; communicate with affected parties; and confirm completion. The standard does not set a universal notice period, deletion deadline, or retention period; the agreement and applicable law supply those dates.

Verify the service outcome and every access, asset, information, integration, and dependency affected by exit. The checklist should identify the responsible acquirer and supplier roles, due date, evidence, exception route, and completion approver for each item.

Return or deletion must follow the agreement and applicable retention, legal-hold, recordkeeping, and technical constraints. Distinguish active data, replicas, backups, logs, physical media, devices, source material, and records that must survive termination. Do not promise deletion where a binding duty requires retention.

Retain the termination decision, risk assessment, current agreement and plan, communication record, named owner, asset inventory, access-removal results, transfer or cancellation acceptance, data export and integrity checks, return or disposal records, approved retention, exception decisions, and confirmation that the parties agree the supplied product or service has ended.

Evidence must match the actual scope. A generic deletion statement does not show which tenant, system, copy, backup, log, device, or subcontractor it covers. Record technical limits, scheduled expiry, continuing safeguards, and the person who accepted any remaining exposure.