A supplier security program can include questionnaires, security requirements, and periodic reviews yet still leave gaps. Requirements may not reflect the service being acquired. Supplier claims may go unverified. Security responsibilities may be unclear once the relationship is underway.

 

ISO/IEC 27036 provides a framework for addressing information security across supplier and acquirer relationships. Its Part 2 sets out requirements for defining, implementing, operating, monitoring, reviewing, maintaining, and improving these relationships. It applies to different types of products and services, including software, hardware, business process procurement, and cloud services.

 

Therefore, ISO 27036 implementation involves more than adding another supplier assessment. It means making security requirements relevant to each relationship, establishing how both parties will meet them, and keeping those requirements aligned as the relationship changes.

 

 

What does ISO 27036 implementation look like in practice

 

ISO/IEC 27036-2:2022 is the main requirements-focused part of the series. It addresses supplier relationships broadly, while Parts 3 and 4 provide additional guidance for ICT supply chains and cloud services. The relevant guidance depends on the products or services involved and the security risks associated with the relationship.

 

For a supplier security program, the practical question is how to apply these requirements to existing processes. An organization may already assess suppliers, review security evidence, and include security clauses in contracts. It can use ISO 27036 to examine whether those activities address the actual relationship and how the organization and supplier maintain security together.

 

The steps below show what this looks like in practice, from tailoring requirements to each relationship through to keeping them aligned as the relationship changes.

 

1. Move from supplier-level checks to relationship-level security

 

A supplier assessment can provide a snapshot of a supplier’s security practices. But that snapshot does not explain every security concern associated with the specific service the organization is acquiring.

 

ISO 27036 takes the supplier relationship into account. Consider what you are acquiring, what information or systems are involved, and how the supplier’s activities could affect its security.

 

This changes how supplier reviews are designed. Rather than applying the same questionnaire to every supplier, you use the nature of the relationship to determine which security issues require attention.

 

For example, a marketing supplier that receives public brand assets has a different security context from a provider that processes customer records. Both may require review, but the information involved, access granted, and potential impact of a security incident differ. A relationship-based approach helps you focus your security requirements on those differences.

 

2. Define security requirements around the acquisition

 

Before agreeing to a supplier relationship, the acquirer needs to understand its business and operational needs and identify the information security requirements relevant to the acquisition.

 

These requirements should reflect the product or service being acquired, not simply a generic list of security expectations.

 

Consider questions such as:

 

• What information will the supplier access, process, store, or transmit?
• Will the supplier connect to organizational systems?
• What security outcomes does the organization need from the service?
• Which legal, regulatory, or contractual requirements apply?
• What responsibilities will the supplier and acquirer each hold?

 

The answers help you define requirements that can be communicated and evaluated.

 

For example, if a supplier will process customer information, the organization may need requirements covering how that information is handled, how security incidents are communicated, and what evidence the supplier must provide. The specific requirements depend on the service and the organization’s obligations.

 

Quick link: A complete guide to vendor risk management

 

3. Establish how supplier security claims will be validated

 

Suppliers may provide security policies, certifications, assessment responses, or other evidence to demonstrate that they meet agreed requirements. Receiving this information is only part of the process. The acquirer also needs to determine whether the evidence supports the supplier’s claims.

 

ISO 27036 implementation should establish how supplier evidence is evaluated and validated against the requirements of the relationship.

 

This includes deciding:

 

• What evidence is relevant to each requirement.
• Whether the evidence is current and applicable to the service.
• Who reviews the evidence and makes the decision.
• What happens when the evidence is incomplete or a requirement is not met.

 

The type of evidence will vary. A supplier’s certification may provide useful assurance about its management system, but it may not demonstrate that every requirement in a particular contract is met. Similarly, a questionnaire response may need supporting documentation or clarification.

 

Example: A supplier states that it reviews access to a service regularly. The acquirer can define what evidence would demonstrate that the review occurs and how it will evaluate that evidence. If the evidence does not address the agreed requirement, the parties can clarify what is missing and determine how to resolve it.

 

4. Build security responsibilities into the relationship

 

Supplier security depends on actions taken by both parties. If responsibilities are unclear, a requirement may exist on paper without either party knowing who is expected to carry it out.

 

Make security responsibilities clear as part of the supplier relationship. These responsibilities may be documented in contracts, service agreements, security schedules, or other agreed records.

 

The parties should understand:

 

• Which security activities each party is responsible for.
• How the supplier demonstrates that requirements are being met.
• How security incidents are reported and handled.
• How changes to the service or relationship are communicated.
• How unmet requirements and remediation actions are addressed.

 

For example, a cloud service agreement may specify that the provider will notify the customer of relevant security incidents, while the customer remains responsible for managing its own user access. The exact allocation depends on the service and agreement.

 

5. Apply the relevant guidance to different supplier arrangements

 

The ISO 27036 series includes guidance for different types of supplier relationships. An organization should consider the nature of its acquisition when deciding which parts are relevant.

 

Supplier arrangement	Guidance to consider
General supplier relationship	Part 2 provides fundamental supplier and acquirer relationship requirements.
Hardware, software, or services supply chain	Part 3 addresses risks across physically dispersed and multi-layered ICT supply chains.
Cloud service relationship	Part 4 provides guidance for cloud service customers and providers.

 

Part 3 is relevant when security risks extend across the supply chain behind a product or service, rather than only the direct supplier. Part 4 focuses on risks associated with acquiring or providing cloud services. Neither replaces the broader relationship requirements in Part 2. 

 

For example, an organization acquiring a cloud-based software product may need to consider the supplier relationship itself, the software supply chain, and the cloud service arrangement. The applicable guidance depends on the details of the acquisition.

 

For a breakdown of each part’s scope, see ISO 27036 parts explained: Which one do you need?

 

6. Keep security requirements aligned as the relationship changes

 

Security requirements that fit a supplier relationship at the start may become less appropriate as the service evolves. The supplier may gain access to new information, change its delivery model, or introduce new subcontractors.

 

You need to identify changes that could affect the security of the relationship and determine whether existing requirements remain suitable.

 

This may involve:

 

• Reviewing changes to the supplier’s service or responsibilities.
• Reassessing risks when access or information processing changes.
• Evaluating updated supplier evidence.
• Following up on unresolved security issues.
• Revisiting requirements when the relationship’s context changes.

 

For example, a supplier initially engaged to provide technical support may later receive access to production systems. That change could affect the security risks and responsibilities associated with the relationship. The organization should evaluate whether its existing requirements and evidence still address the expanded access.

 

 

Manage vendor security requirements with CyberArrow

 

Applying ISO 27036 means keeping each supplier relationship’s requirements, evidence, and follow-up actions connected over time. That gets difficult when the information is spread across spreadsheets, email threads, and shared drives.

 

CyberArrow GRC’s third-party risk management capabilities help you keep this work in one place. With CyberArrow, you can:

 

• Run centralized vendor risk assessments. Assess financial, operational, and security risks consistently across your vendors.

 

• Monitor vendors continuously. Track vendor performance and compliance throughout the relationship, so you can spot changes that need a closer look.

 

• Track compliance status across vendors. See where vendors stand against regulatory requirements and your corporate standards.

 

• Collaborate with vendors directly. Work with vendors on risk assessments, compliance updates, and remediation plans in a shared platform.

 

• Manage issues through to remediation. Identify risks early and track mitigation with automated workflows.

 

• Report to stakeholders and auditors. Generate reports on risk assessments, vendor compliance, and remediation efforts.

 

Your team still decides which security requirements apply to each relationship and whether a vendor’s evidence meets them. CyberArrow helps keep that work organized and visible.

 

Schedule a free demo to see how CyberArrow can support your vendor security program.

 

 

FAQs