ISO/IEC 27036 Supplier Monitoring Evidence Workflow

Start with the approved risk treatment plan and supplier relationship agreement. Monitor the requirements and service levels that protect the specific product or service, information, systems, locations, people, and dependencies in scope. Include both the supplier's effect on the acquirer and, where relevant, risks created by the acquirer's access to supplier information or processes.

Agree what will be measured, how results will be reported, the reporting frequency, and what happens when a result misses its criterion. Increase depth or frequency for higher criticality, larger exposure, weaker assurance, unresolved findings, or greater reliance on subcontractors. Record that approach as the organization's risk decision; ISO/IEC 27036 does not define fixed supplier tiers.

Run a repeatable review cycle: collect the agreed evidence, validate its scope and period, compare results with the acceptance criteria, investigate deviations, decide treatment, assign corrective action, and preserve the conclusion. The acquirer performs or commissions the agreed monitoring; the supplier supplies evidence and supports risk assessments, audits, and corrective-action handling under the agreement.

Do not wait for the calendar review when an event can change the risk. ISO/IEC 27036-2:2022 identifies changes in business or mission, financial strength, ownership, service location, security level, continuity capability, and legal, regulatory, or contractual requirements as examples that can require reassessment and an agreement update.

Choose evidence that can answer the defined monitoring question. Measures and service reports show performance against agreed criteria. Risk assessments and audit reports test compliance or changed exposure. Incident and change histories show whether procedures operated. Corrective-action records show whether findings were addressed. Access reviews, test results, configuration or change records, and transition reports can support specific control conclusions.

A policy, questionnaire, certificate, or assurance report is useful only within its stated scope. Check the covered legal entity, product or service, systems, locations, period, control criteria, exclusions, qualifications, subcontractors or subservice organizations, testing method, exceptions, and management response. Record any gap between that scope and this relationship.

Example review: an access-control obligation calls for a periodic supplier access report. The reviewer checks that the report covers the agreed system, supplier personnel, access period, approvals, removals, and exceptions. A report for the wrong service or period is a coverage gap even if every row in that report passed.

Open a finding when evidence is missing, out of scope, stale for the agreed period, internally inconsistent, or below its acceptance criterion. Assess the information security impact, decide whether the agreement or risk treatment must change, and agree corrective actions with a defined time scale. The supplier's corrective-action process should record initiation, ownership, reporting, and closure.

Escalation is a decision path, not an automatic claim of noncompliance. Depending on the requirement and risk, the outcome can be a request for better evidence, added monitoring, an interim control, corrective action, agreement change, documented residual-risk acceptance, suspension, or termination. Only close the finding when the stated acceptance condition is met or an authorized risk decision records why another outcome is accepted.