Collect evidence for a defined supplier-risk decision, review it at the right cadence, and escalate deviations through the agreement and risk process.
ISO/IEC 27036-2:2022 sets the relationship requirements. ISO/IEC 27036-3:2023 adds guidance for hardware, software, and services supply chains. The agreement and risk assessment determine what to monitor and how often.
Structured answer sets in this page tree.
Cited legal and guidance references.
Build an from each material risk and agreement requirement. For every item, record the measure, evidence source, reporting frequency, acceptance criterion, reviewer, and action when the criterion is missed. ISO/IEC 27036-2:2022 does not set one universal review frequency or evidence list.
Start with the approved risk treatment plan and supplier relationship agreement. Monitor the requirements and service levels that protect the specific product or service, information, systems, locations, people, and dependencies in scope. Include both the supplier's effect on the acquirer and, where relevant, risks created by the acquirer's access to supplier information or processes.
Agree what will be measured, how results will be reported, the reporting frequency, and what happens when a result misses its criterion. Increase depth or frequency for higher criticality, larger exposure, weaker assurance, unresolved findings, or greater reliance on subcontractors. Record that approach as the organization's risk decision; ISO/IEC 27036 does not define fixed supplier tiers.
Run a repeatable review cycle: collect the agreed evidence, validate its scope and period, compare results with the acceptance criteria, investigate deviations, decide treatment, assign corrective action, and preserve the conclusion. The acquirer performs or commissions the agreed monitoring; the supplier supplies evidence and supports risk assessments, audits, and corrective-action handling under the agreement.
Do not wait for the calendar review when an event can change the risk. ISO/IEC 27036-2:2022 identifies changes in business or mission, financial strength, ownership, service location, security level, continuity capability, and legal, regulatory, or contractual requirements as examples that can require reassessment and an agreement update.
Capture owners, evidence, decisions, and review dates in one workflow record so supplier security controls and escalation points stay auditable over time.
Convert ISO/IEC 27036 Supplier Monitoring Evidence Workflow into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Choose evidence that can answer the defined monitoring question. Measures and service reports show performance against agreed criteria. Risk assessments and audit reports test compliance or changed exposure. Incident and change histories show whether procedures operated. Corrective-action records show whether findings were addressed. Access reviews, test results, configuration or change records, and transition reports can support specific control conclusions.
A policy, questionnaire, certificate, or assurance report is useful only within its stated scope. Check the covered legal entity, product or service, systems, locations, period, control criteria, exclusions, qualifications, subcontractors or subservice organizations, testing method, exceptions, and management response. Record any gap between that scope and this relationship.
Example review: an access-control obligation calls for a periodic supplier access report. The reviewer checks that the report covers the agreed system, supplier personnel, access period, approvals, removals, and exceptions. A report for the wrong service or period is a coverage gap even if every row in that report passed.
Open a finding when evidence is missing, out of scope, stale for the agreed period, internally inconsistent, or below its acceptance criterion. Assess the information security impact, decide whether the agreement or risk treatment must change, and agree corrective actions with a defined time scale. The supplier's corrective-action process should record initiation, ownership, reporting, and closure.
Escalation is a decision path, not an automatic claim of noncompliance. Depending on the requirement and risk, the outcome can be a request for better evidence, added monitoring, an interim control, corrective action, agreement change, documented residual-risk acceptance, suspension, or termination. Only close the finding when the stated acceptance condition is met or an authorized risk decision records why another outcome is accepted.