ISO/IEC 27036 FAQ Supplier Monitoring

ISO/IEC 27036-2:2022 requires the acquirer to define monitoring activities, their frequency, reporting, and corrective-action follow-up in the agreement, while the supplier supports those activities and operates its corrective-action process. Both parties reassess relevant changes and preserve the resulting records. The monitoring plan should state what is checked, who checks it, which evidence is accepted, when review occurs, and what triggers escalation after a nonconformity.

Keep strategy review separate from individual supplier monitoring. ISO/IEC 27036-2:2022 requires the supplier relationship strategy and the acquirer relationship strategy to be reviewed at least once a year and after significant business, legal, regulatory, architectural, policy, or contractual changes. The acquirer must also review its strategy when a product or service being procured can significantly affect it; the supplier must review its strategy when establishing a relationship that can significantly affect it. Record the strategy owner, review date, changes, approval, and next review; use the agreement and relationship risk to set each supplier monitoring interval.

A review should decide whether the supplier and acquirer are meeting the agreement, whether the evidence covers the actual product or service and review period, whether risk has changed, and whether any finding needs correction, a control change, an agreement update, formal acceptance, or termination planning.

Do not equate receipt with review. Record the requirement tested, evidence and period, reviewer, result, limitation, finding severity, corrective-action owner and due date, approval, and next scheduled or event-driven review.

Trigger an early review after an incident, material vulnerability, missed service or security measure, expired or qualified assurance, major corrective-action delay, service or architecture change, new data use, access expansion, location change, merger or financial distress, new or changed subcontractor, end-of-support notice, regulatory change, or failed recovery or exit test.

The trigger should route to a named owner who can assess scope and risk, request evidence, update controls or terms, approve a time-bound exception, or begin replacement or termination. A calendar date alone does not handle fast-changing relationships.