ISO/IEC 27036 FAQ Supplier Incidents

ISO/IEC 27036-2:2022 requires the supplier agreement to contain an incident-management procedure and requires both parties to follow the agreed procedure. The standard calls for immediate reporting within that procedure, but the parties and applicable authorities still determine the reportable trigger, recipient, clock, and required content. Part 3:2023 adds supply-chain concerns, including sharing incident information upstream and downstream, responding to vulnerabilities, and examining whether the underlying weakness also affects other components or services.

The first notice should identify what happened or is suspected, when it was detected, the affected service or product, known time window and scope, current operational and information-security impact, containment already taken, whether an upstream supplier is involved, actions the acquirer should take, and the next update time. Mark unknown facts as unknown rather than delaying all notice for a complete investigation.

The contract or incident procedure should say how the supplier protects sensitive investigation material while still giving the acquirer enough information to assess impact and meet its own duties. Where law imposes a deadline or content requirement, record that source separately and make the contractual process capable of supporting it.

Track eradication, recovery, affected-version or service status, corrective actions, owners, due dates, and evidence of completion. Reassess the relationship risk, supplier controls, upstream dependencies, monitoring, assurance, agreement terms, and any downstream commitment the acquirer has made to customers or authorities.

Close the incident only when the agreed closure criteria are met or an authorized owner accepts the remaining actions and risk. Preserve a record of the incident and related decisions for the period required by the agreement, policy, and applicable law.