Use ISO/IEC 27036-2 for supplier-relationship requirements and the other ISO parts for relationship-specific guidance. Use NIST SP 800-161 Rev. 1 Update 1 to integrate cyber supply-chain risk management across enterprise, mission and business, and operational levels.
Use Part 2 for supplier and acquirer relationship requirements and Parts 1, 3, and 4 for concepts or guidance. The series is voluntary; assess contracts, law, customer commitments, and certification scopes separately.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use both when you need relationship-level requirements and an organization-wide cyber supply-chain risk management program. ISO/IEC 27036-2 defines requirements for supplier and acquirer relationships, while Parts 1, 3, and 4 add concepts or guidance. NIST SP 800-161 Rev. 1 Update 1 integrates into enterprise, mission and business process, and operational risk management and supplies tailored control guidance. Neither publication is a certification, and using one does not establish conformity with the other.
Choose the publication from the decision you need to make. Use ISO/IEC 27036 for the supplier relationship, NIST SP 800-161 Rev. 1 Update 1 for the program, or both with a traceable crosswalk when the scopes overlap.
A multipart supplier-relationship series: Part 2 contains requirements, while Parts 1, 3, and 4 provide concepts or guidance for relationship, supply-chain, and cloud contexts.
NIST guidance for cybersecurity supply-chain risk management across enterprise, mission and business process, and operational levels, with control guidance and templates; it is not a certification scheme.
| Dimension | ISO/IEC 27036 | NIST SP 800-161 | Operational implication |
|---|---|---|---|
| Scope and covered activity | ISO/IEC 27036 structures supplier and acquirer security across relationship types, contracts, monitoring, supply-chain visibility, and exit. | NIST SP 800-161 is cybersecurity supply-chain risk-management guidance for systems and organizations. | Use ISO/IEC 27036 to define the supplier relationship and NIST SP 800-161 to organize the risk-management work around that relationship. |
| Primary actors | ISO/IEC 27036 addresses both acquirers and suppliers. Part 2 allocates activities across the relationship lifecycle, while the organization assigns accountable business, procurement, security, legal, technical, and assurance owners. | NIST SP 800-161 addresses executives, enterprise and risk owners, mission and business owners, acquisition, security, privacy, engineering, system, operations, legal, and other stakeholders across three risk levels. | Map the owner of the supplier relationship separately from enterprise, mission or business process, and operational risk owners; one person or group may hold several roles. |
| Scope trigger | Part 2 applies to procurement and supply of products and services. The organization selects and applies lifecycle requirements to its supplier and acquirer relationships and uses risk to determine the depth of supporting guidance and evidence. | NIST SP 800-161 applies when an organization integrates cybersecurity supply-chain risk into enterprise and system risk management. It uses multilevel risk, criticality, and tailoring rather than one universal supplier threshold. | Scope the relationship under ISO/IEC 27036 and the enterprise, mission or business process, and system under NIST before mapping controls or evidence. |
| Requirements and practices | ISO/IEC 27036-2 contains requirements to define, implement, operate, monitor, review, maintain, and improve supplier and acquirer relationships; the other parts add concepts or guidance. | NIST SP 800-161 provides strategy, policy, implementation-plan, acquisition, information-sharing, training, risk-assessment, control, and monitoring guidance. Organizations tailor its guidance to their context. | Use ISO/IEC 27036-2 for the relationship requirements and NIST SP 800-161 for the surrounding program and tailored control work. |
| Evidence and records | ISO/IEC 27036 evidence should show the relationship is being managed: contracts, due diligence, reviews, approvals, and supplier communications. | NIST SP 800-161 evidence should show the risk program is operating: strategy, policy, plans, risk assessments, controls, and monitoring outputs. | Keep supplier relationship records and risk-management records distinct unless the same artifact clearly satisfies both needs. |
| Timing and cadence | Part 2 requires supplier-relationship risks to be addressed continuously and re-examined periodically or after significant business, legal, regulatory, architectural, policy, or contractual changes. | NIST SP 800-161 integrates into recurring enterprise, mission and business process, and operational risk activities, acquisition and system lifecycles, assessments, monitoring, and response. | Coordinate shared evidence dates, but preserve the review event and decision owner required by each scope. |
| Legal force and assurance | ISO/IEC 27036-2 is a requirements standard, but adopting it does not by itself create a law or a standalone ISO/IEC 27036 certification. Agreements, customer assurance, internal review, or an ISMS can make selected requirements reviewable in context. | NIST SP 800-161 is guidance, not a certification scheme. A law, regulation, government policy, acquisition rule, or contract can separately require an organization to use some or all of its practices. | Record the source of each mandatory duty and the assurance route; do not label voluntary guidance as universally binding. |
| Overlap and reuse | ISO/IEC 27036 can supply reusable supplier records, contract evidence, review outputs, and relationship decisions. | NIST SP 800-161 can reuse some of that evidence when the same artifact also supports a supply-chain risk decision. | Reuse evidence only where the same owner, scope, and purpose apply; otherwise keep the records separate. |
| Practical decision rule | Use ISO/IEC 27036 when the main work is defining and managing the supplier relationship. | Use NIST SP 800-161 when the main work is building the supply-chain risk management program around that relationship. | If you need both, use ISO/IEC 27036-2 for applicable relationship requirements, the relevant guidance parts for context, and NIST SP 800-161 to organize supporting activities. |
ISO/IEC 27036 structures supplier and acquirer security across relationship types, contracts, monitoring, supply-chain visibility, and exit.
NIST SP 800-161 is cybersecurity supply-chain risk-management guidance for systems and organizations.
Use ISO/IEC 27036 to define the supplier relationship and NIST SP 800-161 to organize the risk-management work around that relationship.
ISO/IEC 27036 addresses both acquirers and suppliers. Part 2 allocates activities across the relationship lifecycle, while the organization assigns accountable business, procurement, security, legal, technical, and assurance owners.
NIST SP 800-161 addresses executives, enterprise and risk owners, mission and business owners, acquisition, security, privacy, engineering, system, operations, legal, and other stakeholders across three risk levels.
Map the owner of the supplier relationship separately from enterprise, mission or business process, and operational risk owners; one person or group may hold several roles.
Part 2 applies to procurement and supply of products and services. The organization selects and applies lifecycle requirements to its supplier and acquirer relationships and uses risk to determine the depth of supporting guidance and evidence.
NIST SP 800-161 applies when an organization integrates cybersecurity supply-chain risk into enterprise and system risk management. It uses multilevel risk, criticality, and tailoring rather than one universal supplier threshold.
Scope the relationship under ISO/IEC 27036 and the enterprise, mission or business process, and system under NIST before mapping controls or evidence.
ISO/IEC 27036-2 contains requirements to define, implement, operate, monitor, review, maintain, and improve supplier and acquirer relationships; the other parts add concepts or guidance.
NIST SP 800-161 provides strategy, policy, implementation-plan, acquisition, information-sharing, training, risk-assessment, control, and monitoring guidance. Organizations tailor its guidance to their context.
Use ISO/IEC 27036-2 for the relationship requirements and NIST SP 800-161 for the surrounding program and tailored control work.
ISO/IEC 27036 evidence should show the relationship is being managed: contracts, due diligence, reviews, approvals, and supplier communications.
NIST SP 800-161 evidence should show the risk program is operating: strategy, policy, plans, risk assessments, controls, and monitoring outputs.
Keep supplier relationship records and risk-management records distinct unless the same artifact clearly satisfies both needs.
Part 2 requires supplier-relationship risks to be addressed continuously and re-examined periodically or after significant business, legal, regulatory, architectural, policy, or contractual changes.
NIST SP 800-161 integrates into recurring enterprise, mission and business process, and operational risk activities, acquisition and system lifecycles, assessments, monitoring, and response.
Coordinate shared evidence dates, but preserve the review event and decision owner required by each scope.
ISO/IEC 27036-2 is a requirements standard, but adopting it does not by itself create a law or a standalone ISO/IEC 27036 certification. Agreements, customer assurance, internal review, or an ISMS can make selected requirements reviewable in context.
NIST SP 800-161 is guidance, not a certification scheme. A law, regulation, government policy, acquisition rule, or contract can separately require an organization to use some or all of its practices.
Record the source of each mandatory duty and the assurance route; do not label voluntary guidance as universally binding.
ISO/IEC 27036 can supply reusable supplier records, contract evidence, review outputs, and relationship decisions.
NIST SP 800-161 can reuse some of that evidence when the same artifact also supports a supply-chain risk decision.
Reuse evidence only where the same owner, scope, and purpose apply; otherwise keep the records separate.
Use ISO/IEC 27036 when the main work is defining and managing the supplier relationship.
Use NIST SP 800-161 when the main work is building the supply-chain risk management program around that relationship.
If you need both, use ISO/IEC 27036-2 for applicable relationship requirements, the relevant guidance parts for context, and NIST SP 800-161 to organize supporting activities.
ISO/IEC 27036 starts from an acquirer-supplier relationship and its lifecycle. Part 2 contains requirements for planning, supplier selection, agreement, management, and termination. Part 3 adds guidance for multi-layer hardware, software, and service supply chains, and Part 4 addresses cloud customer and provider relationships.
NIST SP 800-161 Rev. 1 Update 1 starts from as an enterprise risk discipline. It organizes decisions across enterprise, mission and business process, and operational levels; integrates C-SCRM with acquisition and system development lifecycles; and provides controls, implementation guidance, and templates. Its audience extends beyond supplier managers to risk, acquisition, security, privacy, engineering, operations, legal, and executive roles.
The ISO comparison uses the 2021, 2022, 2023, and 2016 editions of Parts 1 through 4. The NIST comparison uses Rev. 1 Update 1, which includes updates through November 1, 2024 and supersedes the May 2022 Rev. 1 publication. Recheck the mapping when either source is revised.
Build one crosswalk with separate columns for the business objective, ISO/IEC 27036 requirement or guidance, NIST outcome or control, responsible owner, implementation, evidence, gap, and review trigger. Map only after scoping the ISO relationship and the NIST enterprise, mission or business process, and system context.
Keep legal and contractual duties separate. ISO/IEC 27036-2 uses requirements language for organizations that adopt it, while the other ISO parts and NIST SP 800-161 provide guidance. Neither publication creates a universal breach-notification deadline or becomes binding in every use. NIST states that nongovernmental organizations may use SP 800-161 voluntarily; a law, regulation, government mandate, acquisition rule, customer commitment, or contract may independently require selected practices.
A supplier risk assessment can support ISO planning and selection and a NIST system-level risk assessment, but only if its scope, method, threats, dependencies, and risk criteria satisfy both uses. A contract can implement selected requirements and controls, but it does not prove that the supplier performs them.
An assurance report, component inventory, vulnerability record, incident exercise, continuity test, or monitoring result can be reused when the covered entity, product or service, location, period, control, and reviewer conclusion match both mapped claims.
Enterprise strategy, risk appetite, governance, and multilevel roles are NIST program evidence that a relationship contract usually cannot supply. Detailed mutual agreement, supplier-selection, and termination records are ISO relationship evidence that a high-level C-SCRM policy usually cannot supply. NIST also warns acquirers against a generic requirement to comply with all SP 800-161 controls: select controls for the specific product or service and write the needed contractual language.
Capture owners, evidence, decisions, and review dates in one workflow record so supplier security controls and escalation points stay auditable over time.
Convert ISO/IEC 27036 vs NIST SP 800-161 into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Review the mapping when the relationship scope, supplier, upstream dependency, system architecture, mission or business impact, control implementation, law, contract, or source publication changes. Also review it after a serious incident, material finding, failed control, renewal, or termination decision.
Use the relationship review cadence for ISO/IEC 27036 records and the applicable enterprise, mission or business process, and operational risk cadences for NIST records. Synchronize shared evidence dates, but do not force every decision into one cycle.
At termination, close the ISO relationship actions and update the NIST risk picture for replacement, transition, residual dependencies, retained information, and any new supplier or system exposure.
"overview of the guidance intended to assist organizations"
"fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships"
"provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations"