ISO/IEC 27036 FAQ Supplier Monitoring

ISO/IEC 27036 does not prescribe one universal monitoring interval. Set scheduled and event-driven reviews according to risk, agreement terms, service criticality, evidence availability, and the speed at which the relationship can change.

ISO/IEC 27036-2:2022 requires the acquirer to define monitoring activities, their frequency, reporting, and corrective-action follow-up in the agreement, while the supplier supports those activities and operates its corrective-action process. Both parties reassess relevant changes and preserve the resulting records. The monitoring plan should state what is checked, who checks it, which evidence is accepted, when review occurs, and what triggers escalation after a nonconformity.

A review should decide whether the supplier and acquirer are meeting the agreement, whether the evidence covers the actual product or service and review period, whether risk has changed, and whether any finding needs correction, a control change, an agreement update, formal acceptance, or termination planning.

Do not equate receipt with review. Record the requirement tested, evidence and period, reviewer, result, limitation, finding severity, corrective-action owner and due date, approval, and next scheduled or event-driven review.

Trigger an early review after an incident, material vulnerability, missed service or security measure, expired or qualified assurance, major corrective-action delay, service or architecture change, new data use, access expansion, location change, merger or financial distress, new or changed subcontractor, end-of-support notice, regulatory change, or failed recovery or exit test.

The trigger should route to a named owner who can assess scope and risk, request evidence, update controls or terms, approve a time-bound exception, or begin replacement or termination. A calendar date alone does not handle fast-changing relationships.