ISO/IEC 27036 Onboarding and Offboarding Workflow

Start with a supplier relationship plan. The acquirer identifies the product or service, relevant assets and owners, information that may be shared, legal and regulatory constraints, required permissions, security roles, minimum security requirements, and risks created by dependencies on other suppliers. Management records whether the risk assessment and treatment plan allow procurement to begin.

Selection then tests the supplier against criteria derived from that plan. Relevant criteria can include acceptance of security requirements, demonstrated security capability, audit and assurance terms, transition and termination readiness, capacity, financial strength, service location, and transparency about subcontractors. A certificate can support this decision, but its scope must match the product, service, locations, and entities in the proposed relationship.

Before go-live, the acquirer and supplier approve an agreement that carries the selected security requirements into operation. ISO/IEC 27036-2:2022 calls for roles and responsibilities, required controls, subcontracting terms, service levels or measures, change and incident procedures, compliance monitoring, corrective-action handling, intellectual-property terms, termination conditions, and a termination plan. Add a transition plan when another party previously operated or manufactured the product or service.

The go-live owner should check that the signed agreement and plans are stored under document control, required personnel understand the security terms, agreed communication methods work, access is limited to approved people and assets, and transition results are recorded. If a control will be completed after go-live, record its owner, deadline, compensating control, and risk approval.

Operate the relationship against the approved agreement rather than the original questionnaire. The acquirer and supplier manage agreed changes and incidents, train personnel involved in the relationship, carry out the monitoring plan, and track corrective actions. Keep the current agreement linked to risk assessments, audit reports, transition results, change and incident histories, and the status of each corrective action.

Reassess changes that fall outside the agreed procedure, including changes in ownership, financial strength, service location, security status, continuity capability, or applicable legal, regulatory, and contractual requirements. Decide whether to update controls, accept residual risk, amend the agreement, pause work, or terminate the relationship.

Start from the latest approved agreement and termination plan. Confirm the reason for termination and assess any security risk behind it. Decide whether the product or service will stop, return to the acquirer, or transfer to another supplier. For sudden termination of a critical supply, invoke the applicable continuity arrangements.

Appoint a termination owner and communicate with affected personnel and third parties. Reconcile the asset inventory; agree which assets and records each party will return, transfer, retain, or destroy; protect transfers; remove the other party's logical and physical access; and obtain evidence for agreed destruction. Retention law, regulatory duties, litigation holds, and surviving confidentiality terms can prevent immediate deletion, so record the authority, owner, protection, and end date for retained material.