ISO/IEC 27036 Supplier Assurance Framework

Tie each assurance request to a requirement, risk, and decision. State the product or service, relevant assets, legal entities, locations, systems, personnel, information, subcontractors, and period that the conclusion must cover. Then define the acceptance criterion, evidence source, reviewer, review frequency, change trigger, and response to a gap.

Both parties can create risk for the other. A supplier may handle acquirer information or provide vulnerable components; an acquirer may gain access to sensitive supplier information while inspecting production or service delivery. Scope assurance to the actual direction of access, control, and dependency.

Use the organization's risk method to categorize the relationship, then select the assessment type, level of detail, and frequency. Consider criticality, information sensitivity, privileged or physical access, technology exposure, business dependency, subcontractors, service location and jurisdiction, supplier history, incident history, and the supplier's ability to demonstrate security capability.

A practical model can use internally defined tiers, but label them as organizational categories rather than ISO/IEC 27036 tiers. A lower-risk relationship may need a scoped questionnaire and agreement review. Higher exposure may justify independent reports, technical tests, interviews, audit rights, on-site or remote audit, more frequent reporting, and deeper review of subcontractors. The right combination depends on the risk and what the agreement permits.

Evaluate evidence against the question it is meant to answer. A questionnaire is management's representation unless corroborated. A certificate confirms conformity only for its named standard, certified scope, entities, sites, and validity period. An independent assurance report is limited by its control criteria, system description, period, testing, exceptions, and any excluded subservice organizations. A penetration test covers the tested targets, methods, and date, not every control in the relationship.

For each item, record provenance, version, period, scope, reviewer competence or independence where relevant, limitations, exceptions, and follow-up. Compare the evidence with the agreement and risk treatment plan. Evidence can support a conclusion without covering the entire relationship; mark uncovered requirements as not verified rather than treating the document title or logo as proof.

Example: if a supplier's ISO/IEC 27001 certificate covers its corporate ISMS but excludes the hosting location or managed service being acquired, the certificate can still support covered governance controls. It does not verify the excluded service. Request scoped evidence, add another control, restrict use, choose another supplier, or send the remaining risk to the authorized owner.

Refresh assurance on the agreed schedule and when the evidence or risk changes. Triggers include a security incident, audit nonconformity, failed measure, material change to scope or architecture, new service location or subcontractor, ownership or financial change, loss or scope reduction of relied-on certification, changed continuity capability, renewal, or a new legal, regulatory, or contractual requirement.

A gap does not by itself establish breach, certification failure, or legal noncompliance. Assess its impact on the specific requirement and relationship. The response can be better evidence, increased monitoring, an interim control, corrective action, an agreement update, residual-risk acceptance by the authorized owner, restriction of the service, or termination.