Overview and concepts
Use this part to establish a shared vocabulary for supplier relationships.
Official part record ↗ISO & IEC / Series
ISO/IEC 27036-1:2021, -2:2022, -3:2023, -4:2016 Security in supplier relationships
The 27036 series addresses information security across the relationship between buyers and suppliers. It covers both routine service arrangements and harder-to-see exposures in hardware, software, service and cloud supply chains.
The place in the system
Where it fits
Use it to develop supplier risk and control decisions inside an ISO/IEC 27001 ISMS; Part 2 specifies supplier-relationship requirements but does not replace 27001 certification.
Multipart series
Choose the right part
Each part has its own edition and publisher record.
Supplier relationship requirements
Use this part to identify security requirements for the buyer–supplier relationship.
Official part record ↗Supply-chain guidance
Use this part to examine risk across hardware, software and service supply chains.
Official part record ↗Cloud-service relationships
Use this part to examine security responsibilities in cloud-service supplier arrangements.
Official part record ↗Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Identify which supplier dependencies could affect important information or services.
- Set security responsibilities at onboarding and revisit them during change and exit.
- Ask for evidence matched to the actual product or service and its supply chain.
Evidence to look for
- Supplier dependency inventory
- Contract responsibility and review record
- Supply-chain risk decision log
Illustrative example
What it could look like
A software supplier relies on several subcontractors for development and hosting. The buyer maps those dependencies, agrees security obligations and keeps an exit plan for the data and service.
Boundary to keep clear
The parts have different roles and edition years; a supplier certificate alone does not resolve the buyer's service-specific risk.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.