ISO/IEC 27036 implementation for supplier relationships you can secure and evidence.

What it is

What is ISO/IEC 27036 and what is it used for?

ISO/IEC 27036 is a series of international standards on security in supplier relationships, developed by the joint ISO and IEC subcommittee for information security, cybersecurity and privacy protection (ISO/IEC JTC 1/SC 27). It looks at the relationship from both sides: the acquirer that depends on a product or service, and the supplier that delivers it. Its concern is the risk that travels across that boundary, such as shared data, remote access, outsourced processing, software components and cloud platforms.

Organisations use it to decide which suppliers matter most, what to check before signing, what to write into the agreement, how to monitor performance and how to end a relationship without leaving data or access behind. Suppliers use the same text to understand what a security-conscious customer will expect of them.

Current editions. Part 1 (overview and concepts) is ISO/IEC 27036-1:2021, the second edition, published in September 2021. Part 2 (requirements) is ISO/IEC 27036-2:2022, published in June 2022. Part 3 (hardware, software and services supply chain security) is ISO/IEC 27036-3:2023, published in June 2023. Part 4 (security of cloud services) is ISO/IEC 27036-4:2016, published in October 2016 and confirmed by ISO in 2022, so it remains current. Parts 1 to 3 now carry the title "Cybersecurity — Supplier relationships", replacing the earlier "Information security for supplier relationships" wording.

Who it is for

Who needs ISO/IEC 27036?

Any organisation that hands information, systems or processes to a third party, or that performs that work for others, has a supplier relationship worth securing. Nobody is legally obliged to adopt the series as such, and there is no certificate to hold. Organisations come to Sterling for ISO/IEC 27036 from four starting points:

• A customer's supplier questionnaire keeps arriving. Enterprise clients ask how you vet your own subcontractors, protect their data in your hands and report incidents. A process aligned to the series gives consistent, evidenced answers instead of a new scramble each time.
• A tender asks how you manage third-party risk. Bid teams need a described method, named responsibilities and records, not a statement of good intent.
• A regulator or auditor has questioned your outsourcing controls. Sector rules and ISO/IEC 27001 audits both look closely at suppliers. The series supplies a recognised structure for the answer, while the specific legal obligations are confirmed with your legal advisers.
• A group needs one approach across its companies. Subsidiaries source from overlapping suppliers under different contracts and different checks. A shared tiering model and common clauses remove the gaps between them.

Requirements

What are the ISO/IEC 27036 requirements?

Only Part 2 is written as requirements; the other parts give concepts and guidance that support it. Part 2 is not a management system standard, so it is used to shape processes and contracts rather than to earn a certificate. The summary below follows the four parts as ISO describes them; your programme is checked against the purchased text of each part you adopt.

• Part 1 Overview and concepts: the introductory part, setting out the ideas the other parts build on from the acquirer's and the supplier's point of view.
• Part 2 Requirements: fundamental security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving relationships between acquirers and suppliers, for any type of organisation.
• Part 3 Hardware, software and services supply chain security: visibility into dispersed, multi-layered supply chains, responding to the risks found, and building security into system and software life cycle processes.
• Part 4 Security of cloud services: guidance for cloud service customers and providers on seeing and managing the risks of acquiring or providing cloud services.

Putting it into practice

How do you implement ISO/IEC 27036?

Implementation means building a supplier security process that runs every time you acquire or supply a service, not writing a policy about one. Because the series is guidance, nobody issues an ISO/IEC 27036 certificate at the end; the proof is the evidence the process produces, and, where you want independent assurance, the ISO/IEC 27001 certification audit of the ISMS it sits in.

1. 01
   Decide your role and the scope.Confirm whether you act as acquirer, supplier or both, which relationships matter and which parts of the series apply, including Part 4 for cloud.
2. 02
   Gap analysis: compare current practice with the series.Review procurement steps, contract templates, access management and supplier reviews against Part 2 and the relevant guidance, then agree actions, owners and dates.
3. 03
   Build the supplier security process.Risk tiering, due diligence questions, standard clauses, onboarding, monitoring, incident handling and exit, each with an owner and a record.
4. 04
   Run it on real suppliers and review.Apply the process to the critical tier first, then audit it internally and bring the results to management review, closing findings with evidence.
5. 05
   Prove it to the people who ask.Assemble the evidence for customers, tenders and regulators, and, where ISO/IEC 27001 is in scope, prepare the supplier controls for the accredited certification body's audit.

Check the route before you sign. If anyone offers an "ISO/IEC 27036 certificate", ask who issues it, under which accreditation, and whether your customer will accept it. Where independent assurance is the goal, ISO/IEC 27001 certification from a body accredited by a signatory of the Global ACI arrangement is the recognised route; verify the body's accreditation directly with the accreditation body named. How to choose a credible ISO/IEC 27001 certification body · The certification buyer's checklist

Cost

How much does ISO/IEC 27036 implementation cost?

Supplier security scales with the supply base, not with headcount alone. A software firm with a dozen critical providers and a bank with hundreds of outsourcing arrangements need very different programmes. Every Sterling proposal shows each component and one all-inclusive proposal.

Timeline

How long does ISO/IEC 27036 implementation take?

Designing the process is quick; running it long enough to show results takes longer. As an estimate, a focused programme for one organisation often takes two to five months before the critical suppliers have been through the full cycle, depending on how many there are, how fast contracts can change and how available your procurement and security people are.

Share any questionnaire or audit date at the outset, and we will say plainly what is achievable by then.

Your engagement

What your ISO/IEC 27036 engagement includes

The engagement follows Sterling OS™. You choose one support level: Design™, where our consultants guide your team as it builds the process, or Drive™, where we manage the work and your people approve and operate it. Either way, Automate™ puts the process in Effivity, and Sustain™ keeps it running after implementation, and after certification where ISO/IEC 27001 is in scope.

• Scope, gap analysis and plan

  Your role, the suppliers in scope and the applicable parts, agreed before work starts.

• Supplier security process and templates

  Tiering criteria, due diligence questions, contract clauses and exit steps, built with procurement and legal.

• Effivity ISO & GRC software

  Supplier records, reviews and actions in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  The supplier process audited and reviewed, with findings closed on evidence.

• Evidence for those who ask

  A reusable response pack for customer questionnaires, and ISO/IEC 27001 audit preparation where in scope.

There is no ISO/IEC 27036 certificate, and Sterling does not certify, attest or accredit; where ISO/IEC 27001 certification is in scope, the independent certification body makes the decision.

Often combined with

Standards organisations pair with ISO/IEC 27036

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• AEOAuthorised Economic Operator (AEO) readiness: what customs examines, who can apply and how Sterling prepares your controls and evidence for the customs visit.
• BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
• C-TPATC-TPAT requirements and validation readiness for US importers and overseas suppliers: the Minimum Security Criteria, CBP's process and how Sterling helps.
• CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.