Most security incidents don’t stay inside the organization that suffered them. Attackers go through suppliers: a software vendor with access to customer data, a managed service provider with admin credentials, or a library buried in a product’s dependencies. Regulators have noticed, and frameworks like ISO 27001, NIS2, and DORA now expect organizations to control supplier risk, not just assess it once.

 

ISO 27036 is the international standard series built for this problem. It provides guidance and requirements for managing information security in supplier relationships. It addresses the security responsibilities of both organizations acquiring products and services and the suppliers providing them.

 

This guide explains what ISO/IEC 27036 covers, who can benefit, and how it fits into a supplier security program.

 

 

What is ISO 27036?

 

ISO 27036 is a series of international standards focused on information security in supplier relationships. It helps organizations address risks that arise when they acquire or provide products and services. These risks can arise from shared access to information and systems, unclear security responsibilities, weaknesses in supplier practices, or dependencies on other organizations.

 

For example, a company might use an external software provider that needs access to customer data. The company must understand the security risks associated with that access, while the provider must protect the information it handles and meet the agreed security requirements.

 

The series addresses both sides of a supplier relationship. Organizations acquiring products or services need to establish appropriate security requirements and oversee the relationship. Suppliers need to understand their responsibilities and manage the risks associated with the products or services they provide.

 

Quick link: What is vendor compliance?

 

Who needs ISO 27036?

 

ISO 27036 can help organizations that acquire or provide products and services where information security is a concern. Its relevance depends on the nature of the relationship, the information involved, and the risks associated with the service.

 

Typical users include:

 

• Organizations managing suppliers: Businesses that share sensitive information with vendors or depend on external services can use the series to define security expectations and oversee supplier relationships.

 

• GRC and third-party risk teams: These teams can use its guidance to support supplier risk assessments, security requirements, and ongoing oversight.

 

• Information security teams: Security professionals can use it to address risks involving supplier access, external systems, software dependencies, and cloud services.

 

• Procurement and legal teams: These teams can work with security and risk specialists to incorporate appropriate information security requirements into supplier selection and agreements.

 

• Software, hardware, and service providers: Suppliers can use the guidance to understand security expectations across their supply chains and customer relationships.

 

• Cloud service customers and providers: Organizations using or providing cloud services can refer to Part 4 for guidance on cloud-specific information security risks.

 

The series is relevant to organizations of different sizes and types. A smaller business might apply its guidance to a few critical suppliers, while a larger organization may need different approaches for software vendors, cloud providers, outsourced operations, and complex supply chains.

 

 

What are the four parts of ISO 27036?

 

The four parts address different aspects of information security in supplier relationships. They build on one another: Part 2 provides general requirements, while Parts 3 and 4 address more specific supply arrangements.

 

Part	Current edition	Main focus
ISO/IEC 27036-1	2021	Overview and concepts
ISO/IEC 27036-2	2022	Supplier relationship requirements
ISO/IEC 27036-3	2023	Hardware, software, and services supply chain security
ISO/IEC 27036-4	2016	Security of cloud services

 

Part 1: Overview and concepts

 

ISO/IEC 27036-1:2021 introduces the series and explains the concepts used throughout its other parts. It establishes a shared understanding of information security in supplier relationships and considers the perspectives of both acquirers and suppliers.

 

This part is useful when an organization is new to the series or needs to understand how its different parts fit together. It provides context rather than detailed operational requirements.

 

Part 2: Requirements (supplier relationship)

 

ISO/IEC 27036-2:2022 specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining, and improving supplier and acquirer relationships.

 

It applies broadly to procuring and supplying products and services, including hardware, software, outsourced processes, and cloud computing services.

 

Part 2 is the main reference for organizations establishing a structured approach to supplier relationship security. It helps them define security expectations and manage the relationship beyond the initial procurement stage.

 

It also recognizes that effective supplier security depends on supporting organizational processes, including risk management, business management, operations, human resources, and information security.

 

Part 3: Hardware, software, and services supply chain security

 

ISO/IEC 27036-3:2023 provides guidance for acquirers and suppliers dealing with hardware, software, and services supply chains.

 

These supply chains can involve multiple organizations, locations, and layers of dependencies. For example, a company may purchase software from one provider while that provider relies on external libraries, development tools, or other suppliers.

 

Part 3 addresses how organizations can gain visibility into supply chain security risks, respond to those risks, and integrate information security practices into system and software life cycles.

 

It is particularly relevant to organizations that develop, acquire, integrate, or supply technology products and services. It helps extend security considerations beyond the direct supplier relationship to the wider supply chain.

 

Part 3 does not cover business continuity management and resilience; those concerns require additional guidance.

 

Part 4: Security of cloud services

 

ISO/IEC 27036-4:2016 provides guidance for cloud service customers and providers on identifying and managing information security risks associated with cloud services.

 

Cloud arrangements raise questions about data access, security responsibilities, service dependencies, and the risks of acquiring or providing cloud-based services.

 

For example, a company using a cloud-hosted customer relationship management system needs to understand the service’s security risks and set appropriate expectations with the provider.

 

Part 4 helps organizations address these cloud-specific considerations within their supplier relationships. It does not provide a complete guide to how cloud providers should implement and operate their own information security programs. ISO/IEC 27002 and ISO/IEC 27017 provide relevant additional guidance on security controls.

 

How ISO 27036 fits into a supplier security program

 

ISO 27036 provides guidance for managing information security in supplier relationships. Organizations can use it to strengthen an existing supplier security program or build a more structured approach to managing these risks.

 

The following activities show where the series fits into the broader program. They provide a practical overview, not a substitute for the standard’s detailed requirements and guidance.

 

Quick link: A complete guide to vendor risk management

 

1. Identify suppliers and understand the relationship

 

Identify the suppliers that handle organizational information, access systems, or provide services that affect information security.

 

Understand what each supplier provides, what information it handles, which systems it can access, and how the organization depends on the service. These details help determine which security risks need attention.

 

2. Assess supplier security risks

 

Evaluate the risks associated with each relationship. Consider the sensitivity of the information involved, the supplier’s level of access, the service’s importance, and the potential consequences of a security incident.

 

The assessment should inform the security requirements applied to the supplier. A provider handling sensitive customer information may require more extensive review than a supplier with no access to organizational data or systems.

 

3. Define security requirements and responsibilities

 

Establish the security expectations that apply to the relationship. Depending on the service, these may address data protection, access management, incident notification, security evidence, subcontracting, and termination arrangements.

 

Make sure the supplier and the acquiring organization understand their respective responsibilities. Where relevant, incorporate the agreed requirements into contracts and other supplier agreements.

 

4. Monitor the relationship

 

Supplier security does not end when a contract is signed. Services, access permissions, technology, and supplier dependencies can change over time.

 

Review supplier security information and reassess risks when significant changes occur. The extent of monitoring should reflect the relationship’s risk and the organization’s requirements.

 

5. Review changes and end access when the relationship ends

 

Changes to a service, a supplier’s subcontractors, or the information being shared may affect the original risk assessment. Review these changes to determine whether security requirements need updating.

 

When a relationship ends, address matters such as removing access, returning or securely disposing of information, and confirming any remaining obligations. These activities help organizations manage security risks throughout the relationship rather than treating supplier security as a one-time assessment.

 

How CyberArrow can support supplier security management

 

Managing supplier security involves keeping risk assessments, security requirements, evidence, and remediation activities organized and up to date. When this information sits across disconnected documents and systems, teams may struggle to track outstanding issues and understand supplier risk status.

 

CyberArrow GRC supports third-party risk management through vendor/supplier assessments, risk tracking, and centralized oversight of relevant GRC activities.

 

With CyberArrow, organizations can:

 

• Maintain supplier risk and assessment records.
• Track identified risks and remediation actions.
• Organize relevant evidence and compliance information.
• Monitor assessment status and report on outstanding issues.

 

These capabilities can support the operational work involved in a supplier security program. Teams still need to determine which ISO 27036 guidance applies to their relationships and establish appropriate security requirements.

 

Schedule a demo to see how CyberArrow can support your third-party risk management workflows.

 

 

FAQs