Identify upstream suppliers that can materially affect delivery, then obtain proportionate visibility and assurance through the direct supplier.
Use Part 2 for supplier and acquirer relationship requirements and Parts 1, 3, and 4 for concepts or guidance. The series is voluntary; assess contracts, law, customer commitments, and certification scopes separately.
Structured answer sets in this page tree.
Cited legal and guidance references.
ISO/IEC 27036 describes successive supplier relationships in a multi-layer ; it does not define a mandatory "fourth-party" register. Identify the upstream products, services, processes, and organizations whose compromise, outage, substitution, or loss of support could materially affect the acquired product or service. Obtain proportionate visibility and assurance through the direct supplier, and record what remains unknown.
Start with the acquired product or service and trace security-relevant dependencies upstream. Prioritize a dependency when it handles sensitive information, has privileged or production access, supplies a critical component or platform, controls updates or signing, creates geographic or provider concentration, is difficult to replace, or can interrupt a critical function.
The supply-chain view is relative: an organization can be the acquirer of an upstream component and the supplier of a downstream product. The end customer often has limited control over its direct supplier's requirements and no direct control over suppliers farther upstream, so the direct agreement is the main route for visibility, flow-down, assurance, and change notice.
Example: a software-as-a-service provider can rely on a cloud infrastructure provider, an identity service, external software components, and a separate support operator. Investigate the dependencies that can expose customer information, interrupt the service, control privileged access or updates, or prevent safe exit; do not require the same evidence for an immaterial office supplier.
Ask the direct supplier for information that supports a decision, not an unlimited list of every subcontractor. Depending on risk, this can include named critical sub-suppliers, dependency categories, service and data locations, access roles, component or service inventories, assurance coverage, incident dependencies, continuity arrangements, and the process for notifying material changes.
ISO/IEC 27036-2 includes subcontractor transparency in supplier selection criteria, including use of subcontractors, access to the acquirer's information, personnel, changes, assurance, audit, and confidentiality. The specific contract should define which of those items apply and what the acquirer may do after an unacceptable change.
If direct visibility is unavailable, reduce the uncertainty with independent assurance, technical isolation, telemetry, tested portability, alternative sources, inventory and provenance controls, or a time-limited risk acceptance. Do not describe an unknown dependency as controlled.
Keep a dependency map that names critical direct and known indirect suppliers or, where names cannot be disclosed, the dependency category, function, location, access, concentration, and assurance route. Record the map's source, date, owner, confidence, and known gaps.
Link each critical dependency to agreement terms, supplier evidence, monitoring, incident and continuity arrangements, change notices, corrective actions, and the current risk decision. A direct supplier's general certificate does not prove that every upstream provider, location, component, or service is in scope.
For an accepted visibility limit, record why more detail is unavailable, which decisions the limit affects, the compensating controls, the approving risk owner, and the next review trigger.
Capture owners, evidence, decisions, and review dates in one workflow record so supplier security controls and escalation points stay auditable over time.
Convert ISO/IEC 27036 Indirect and Fourth Party Suppliers into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Review the map and treatment at the planned risk-based interval and after a material sub-supplier notice, serious incident, critical vulnerability, ownership change, service or data-location move, component substitution, concentration increase, loss of support, control failure, or continuity test failure.
A change does not always require termination. The response can be updated assurance, remediation, a technical restriction, a replacement component, an alternative provider, reduced use, or approved residual risk. Record the decision and effective date.
At termination, confirm whether indirect providers retain information, credentials, support access, backups, logs, or other assets. Route return, disposal, retention, and verification through the direct supplier unless a separate agreement gives the acquirer a direct right.