ISO/IEC 27036 has four parts, each addressing a different aspect of information security in supplier relationships. One provides an overview of the series, another sets out supplier relationship requirements, while the remaining two focus on ICT supply chains and cloud services.

Knowing what each ISO 27036 part covers helps you identify which guidance applies to your supplier arrangements. You may need only one part for a particular concern, or several parts to address different aspects of the same relationship.

ISO 27036 parts at a glance

Part	Focus	Who it’s for	When to use it
ISO/IEC 27036-1:2021	Overview and concepts	Anyone new to the series, in either role	To understand the series and its terminology
ISO/IEC 27036-2:2022	Supplier relationship requirements	Acquirers and suppliers setting up or improving supplier security arrangements	To define and manage security requirements across supplier relationships
ISO/IEC 27036-3:2023	Hardware, software, and services supply chain security	Organizations buying or supplying ICT products and services	To address risks across ICT supply chains
ISO/IEC 27036-4:2016	Cloud services security	Cloud service customers and providers	To manage risks of acquiring or providing cloud services

ISO/IEC 27036-1: Overview and concepts

ISO/IEC 27036-1:2021 introduces the concepts and guidance covered by the other parts of the series. It provides a common starting point for organizations that want to understand information security in supplier relationships.

The part considers both sides of a supplier relationship: the organization acquiring a product or service and the supplier providing it. This helps establish a shared understanding of their responsibilities and the security concerns that can arise when they exchange information, access systems, or depend on each other’s services.

A company reviewing its supplier security approach for the first time can use Part 1 to understand the concepts behind the series before deciding which requirements or guidance apply to its suppliers.

ISO/IEC 27036-2: Supplier relationship requirements

ISO/IEC 27036-2:2022 is the requirements-focused part of the series. It specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining, and improving supplier and acquirer relationships.

Its scope covers different types of procurement and supply arrangements. These include manufacturing, business process procurement, hardware and software components, knowledge-based services, and cloud computing services.

Quick link: How to implement a vendor risk management program?

When do you need Part 2?

Use Part 2 when you need a structured basis for establishing and maintaining information security requirements with suppliers.

For example, an organization outsourcing a business process may need to define security expectations for the supplier, establish how those expectations will be monitored, and review the relationship over time. Part 2 provides requirements relevant to these activities. It is also a useful starting point when an organization wants to improve its supplier security arrangements but does not have a specific ICT supply-chain or cloud-service concern.

ISO/IEC 27036-3: Hardware, software, and services supply chain security

ISO/IEC 27036-3:2023 focuses on information security risks across hardware, software, and services supply chains. These supply chains can involve multiple suppliers, subcontractors, development teams, and service providers operating across different locations.

As a result, an organization may have limited visibility into how a product or service is developed, delivered, or supported. Security risks can arise at different points in the supply chain, not only through the direct supplier.

Part 3 provides guidance to product and service acquirers and suppliers on gaining visibility into these risks, managing them, and integrating information security practices into system and software life cycles.

When do you need Part 3?

Consider Part 3 when your security concerns extend beyond the direct supplier to the hardware, software, or services being acquired and the wider supply chain behind them.

For example, a company purchasing a software product may need to consider risks associated with third-party components, development practices, and suppliers involved in delivering or maintaining the product. Part 3 provides relevant guidance for understanding and addressing these supply-chain risks.

ISO/IEC 27036-4: Cloud services security

ISO/IEC 27036-4:2016 focuses on information security risks associated with cloud services. It provides guidance for both cloud service customers and cloud service providers. This part helps organizations gain visibility into risks arising from acquiring or providing cloud services and respond to risks that could affect the security of their information and systems.

It is important to understand its scope. Part 4 addresses security in the cloud service relationship. It does not provide a complete guide to how a cloud provider should implement and operate its information security program. ISO 27002 and ISO 27017 provide related guidance on information security controls and their application to cloud services.

When do you need Part 4?

Use Part 4 when your organization acquires or provides cloud services and needs guidance on the information security risks associated with that relationship.

For example, a company storing customer information with a cloud service provider needs to understand the security risks involved in using the service and how those risks affect both parties. Part 4 provides guidance relevant to that arrangement.

Are you the acquirer or the supplier?

The series is written with two roles in mind. The acquirer buys a product or service, and the supplier provides it. Part 1 addresses both perspectives, Part 2 covers supplier and acquirer relationships, and Parts 3 and 4 provide guidelines for both the acquirer and the supplier.

What changes is your focus:

• Acquirers concentrate on selecting suppliers, setting security requirements in agreements, assessing risk, and monitoring performance.
• Suppliers concentrate on understanding customers’ security requirements, demonstrating that their controls meet them, and managing their own suppliers.

Many organizations are both. A SaaS company is the supplier to its customers and the acquirer from its cloud provider, so it applies the same parts from each side.

Quick link: A complete guide to vendor risk management

How the ISO 27036 parts work together

The parts address different areas, so choosing one doesn’t make the others irrelevant. Consider a company buying a cloud-based software product:

• Part 1 gives the shared terminology and risk framing.
• Part 2 supplies the requirements for the supplier relationship and its agreements.
• Part 3 helps with risks from the software components and the suppliers behind them.
• Part 4 helps with the risks of relying on the cloud service.

A company outsourcing a business process, by contrast, may find Part 2 most directly relevant and need none of the others.

Once you know which parts apply, the next step is to turn them into a working process: assess suppliers by risk, set security requirements in agreements, and monitor performance over time.

Manage vendor risk with CyberArrow

Knowing which ISO 27036 parts apply is only the first step. The harder part is applying them across every supplier: assessing risk, tracking requirements, collecting evidence, and following up on gaps.

CyberArrow GRC offers third-party risk management in one platform. With CyberArrow, you can:

• Assess vendors and keep results in a single record, instead of scattered spreadsheets.
• Tailor assessments to your own supplier security requirements.
• Manage onboarding, risk assessment, and ongoing compliance monitoring in one place.
• Work with vendors on risk assessments, compliance updates, and remediation plans.
• Gather supporting evidence across systems and documents.
• Generate reports on assessments, risk levels, and mitigation efforts.

Whether you’re the acquirer, the supplier, or both, one record of vendor risk and evidence makes reviews, audits, and customer questionnaires easier to answer.

Schedule a free demo to see how CyberArrow can support your vendor risk management process.

FAQs