ISO/IEC 27036

Why does it matter?

Acquirers and suppliers can cause information security risks to each other, because each gets access to the other's assets, such as information and information systems, and because their business objectives and security approaches differ (Part 2 Introduction). Neither side can manage this alone: in a supply chain, the security management of one organization is not enough to keep hardware, software and services secure (Part 3, Clause 5.2). ISO/IEC 27036 gives both sides a shared structure for the work.

Key benefits include:

• Risks managed on both sides

The risks should be managed by both acquirers and suppliers, and the requirements in Part 2 are written for both roles (Part 2 Introduction and Clause 5.1.1).

• Mutual understanding

Part 2 facilitates understanding of the other party's approach to information security and its tolerance for information security risk (Part 2 Introduction, item b).

• Objectives that support assurance

Clauses 6 and 7 state objectives that Annex C consolidates, which gives acquirer and supplier a basis for assurance (Part 2 Introduction, item f; Annex C).

• Visibility beyond the first supplier

Part 3 addresses supply chains in which acquirers see only the first or second link, and aims for visibility, traceability and transparency (Part 3 Introduction and Clause 5.1).

• Cloud-specific guidance

Part 4 guides cloud service customers and providers on gaining visibility into the risks of using cloud services and on responding to risks specific to acquiring or providing them.

How does it work?

Part 1:2021 introduces the concepts. Clause 5 covers motives for supplier relationships (5.1), their types (5.2: products, services, ICT supply chain and cloud computing), information security risks and associated threats (5.3), managing those risks (5.4) and ICT supply chain considerations (5.5). Clause 6 summarizes the structure of all four parts. Its Introduction counts any relationship with information security implications as a supplier relationship, from IT and healthcare services to janitorial services, consulting, R&D partnerships and cloud computing.

Part 2:2022 is the requirements part. Clause 6 applies life cycle processes taken from ISO/IEC/IEEE 15288 to the management of several supplier relationships: agreement processes (6.1), organizational project-enabling processes (6.2), technical management processes (6.3, including risk management in 6.3.4) and technical processes (6.4). Clause 7 applies five processes to a single relationship, and each is written as an objective, inputs, activities and outputs. Tables mark text for the acquirer, the supplier or both. Annex A maps to 15288, Annex B to the ISO/IEC 27002 controls, and Annex C lists the objectives.

Part 3:2023 and Part 4:2016 are guidelines. Part 3 mirrors the life cycle processes of ISO/IEC/IEEE 15288 and 12207 in Clause 6 and maps them to ISO/IEC 27002 controls in Annex A, and Annex B (informative) lists the essential elements of a software bill of materials. Part 4 supports information security management for the use of cloud services; ISO last confirmed it in March 2022.

Key Elements

• Supplier relationship life cycle (Part 2, Clause 7)

Planning (7.1), selection (7.2), agreement (7.3), management (7.4) and termination (7.5), each with objective, inputs, activities and outputs.

• Agreement processes (Part 2, Clause 6.1)

The acquisition process (6.1.1) and the supply process (6.1.2). The acquirer's objective is a supplier relationship strategy based on its information security risk tolerance.

• Roles in the relationship (Part 1, Clause 3)

Acquirer: anybody that procures a product or service. Supplier: an organization or individual that enters into an agreement with the acquirer. Supply chain: successive relationships in which each organization acts as acquirer, supplier or both.

• Risk management process (Part 2, Clause 6.3.4)

Part of the technical management processes, applied to the information security risks of the supplier relationship.

• Supply chain visibility (Part 3, Clause 5)

Visibility, traceability and transparency, supported by defined security requirements, monitoring and contractual expectations. Part 3 names intentional events such as malicious code insertion and counterfeit products, and unintentional events such as poor development practices.

• Software bill of materials (Part 3, Clause 3.1 and Annex B)

An inventory of software components, sub-components and dependencies, with the essential elements listed in Annex B (informative).

• Life cycle technical processes (Part 3, Clause 6.4)

Fourteen processes from business or mission analysis (6.4.1) through verification (6.4.9), transition (6.4.10), operation (6.4.12) and disposal (6.4.14).

• Cloud services guidance (Part 4)

Guidance for the customer and provider on the risks of using cloud services, with business continuity and the provider's own security operations left to other standards.

What does it cover?

ISO/IEC 27036-2 specifies requirements for supplier and acquirer relationships covering any procurement and supply of products and services, such as manufacturing or assembly, business process procurement, software and hardware components, knowledge process procurement, build-operate-transfer and cloud computing services (Part 2, Clause 1). It applies to all organizations regardless of type, size and nature. To meet the requirements an organization is expected to have foundational processes in place or in planning, including business management, risk management, operational and human resources management, and information security.

What are its objectives?

The Introduction to Part 2 gives six aims:

To specify fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships (item a).

To help each party understand the other's approach to information security and its tolerance for risk (item b).

To reflect the complexity of managing risks that can have information security impacts in supplier and acquirer relationships (item c).

To serve any organization willing to evaluate information security in supplier or acquirer relationships (item d).

To state that it is not intended for certification purposes (item e).

To set defined information security objectives that are a basis for assurance in a supplier and acquirer relationship (item f).

Framework in Context

The series elaborates the supplier relationship controls of ISO/IEC 27002 (Part 1 Introduction); in ISO/IEC 27002:2022 they are 5.19 to 5.23. Parts 2 and 3 follow the life cycle processes of ISO/IEC/IEEE 15288, and Part 3 also follows ISO/IEC/IEEE 12207. Business continuity of the supply chain is out of scope and sits with ISO/IEC 27031, and Part 4 does not tell a cloud provider how to run its own security, which ISO/IEC 27002 and ISO/IEC 27017 cover. None of the four parts has an amendment. Part 1 entered systematic review on July 15, 2026, with no revision project listed.

Common Framework Mappings

ISO/IEC 27036 is commonly mapped to the ISO/IEC 27000 standards it supports and to the supply chain, cloud and third-party assessment frameworks that address the same supplier risks.

Mapped frameworks include:

ISO 27001:2022

ISO 27002:2022

ISO 27005:2022

ISO 27017

NIST SP 800-161 Rev.1

NIST CSF 2.0

NIST 800-53 Rev.5

CSA CCM v4

Shared Assessments SIG

IEC 62443