ISO/IEC 27036 FAQ Risk Tiers

ISO/IEC 27036-2:2022 requires the acquirer's risk assessment to be commensurate with the criticality of the product or service and requires an acceptable risk level and treatment plan. A tier is an internal way to apply those decisions consistently; it is not an ISO classification or certificate and does not replace the relationship-specific assessment.

Define each factor, data source, scoring or decision rule, override, approver, and resulting treatment before applying labels. Keep impact separate from control evidence: a critical supplier does not become low impact because it has strong assurance, and weak evidence does not by itself describe the business consequence of failure. Calculate or decide inherent risk first, evaluate controls and evidence, then record residual risk and the resulting tier or treatment.

Allow an override when one fact dominates the result, such as unrestricted production access, regulated data, a single-source critical component, or an exit time longer than the business can tolerate. Record the reason instead of changing inputs to force the expected tier.

Reassess when the product or service scope, information, access, integration, location, supplier ownership or financial condition, subcontractors, concentration, support status, threat exposure, agreement, law, or business criticality changes. Incidents, repeated findings, missed corrective actions, and failed recovery or exit tests are also useful triggers.

Keep the prior tier, evidence, rationale, approver, effective date, treatment changes, and next review. If the tier remains unchanged after a material event, record why the existing treatment is still sufficient.