Decide whether a supplier relationship is understood, treated, agreed, monitored, and closed with current evidence.
Use Part 2 for supplier and acquirer relationship requirements and Parts 1, 3, and 4 for concepts or guidance. The series is voluntary; assess contracts, law, customer commitments, and certification scopes separately.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this checklist before approval, during operation, after material change, and at exit. A completed questionnaire is not the decision: the and supplier must identify their risks, agree responsibilities and evidence, treat unacceptable exposure, and record who approved any residual risk. Scale the work to the product or service, access, dependence, supply-chain depth, and applicable obligations.
ISO/IEC 27036-2:2022 applies to organizations of any type or size and to procurement and supply of products and services, including manufacturing, business-process procurement, software and hardware components, build-operate-transfer arrangements, and cloud services. It is a voluntary international standard unless law, regulation, policy, customer terms, or a contract makes selected requirements binding. The checklist does not replace those separate duties.
The assessment must describe the actual relationship before it scores risk. Identify the legal entities and accountable owners, the product or service, intended use, information and systems involved, access method and privilege, processing and support locations, business criticality, recovery need, planned term, and feasible alternatives.
Assess risks to both parties. ISO/IEC 27036-2 specifically includes business dependence, underlying technology, subcontractors, past performance, contractual arrangements, and the supplier's ability to demonstrate information-security capability. Add product provenance, component and update dependencies, and end-of-support exposure for an ICT supply chain.
Choose due-diligence depth from risk, not supplier size or a single tier label. Review the exact entity, service, location, and period covered by certificates, attestations, tests, continuity evidence, and audit reports. Record exclusions, reliance on management statements, stale evidence, and findings that remain open.
If the supplier will not accept a requested control or audit right, do not mark the item complete. Decide whether alternative evidence, a technical restriction, reduced scope, additional monitoring, a different supplier, or explicit residual-risk acceptance makes the relationship acceptable. ISO/IEC 27036-2 recommends that procurement not proceed when identified risk cannot be reduced to the acceptable level; the authorized risk owner must apply the organization's approval rules.
Approval evidence should let a later reviewer reconstruct the decision: scoped inventory record, assessment criteria and results, treatment plan, due-diligence evidence, exceptions, legal and regulatory review where applicable, selected supplier rationale, agreement, named approver, and next review trigger.
Operational evidence should show that the agreed controls work for the covered service and period. Use access reviews, service and security measures, vulnerability and patch records, incident records, assurance reports, continuity tests, sub-supplier changes, corrective actions, and risk reassessments as applicable.
Do not accept a document by title alone. Record the provider, covered entity and service, period, locations, method, qualifications, findings, reviewer conclusion, follow-up owner, and due date.
Capture owners, evidence, decisions, and review dates in one workflow record so supplier security controls and escalation points stay auditable over time.
Convert ISO/IEC 27036 Third Party Risk Checklist into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
Rerun affected checklist items at the planned interval and when a significant business, legal, regulatory, architectural, policy, or contractual change occurs. Also reopen the decision after a serious incident, material control failure, new privileged access, new processing location, ownership change, critical sub-supplier change, major release, missed recovery objective, or change in business dependence.
At renewal, confirm that the scope, risk, evidence, pricing assumptions, control responsibilities, and exit plan still match the service. At termination, execute the transition plan, remove access, recover assets, return or dispose of information subject to retention duties, preserve required records, and document any obligation that survives.