Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 27036 โ Information Security for Supplier Relationships
Information Technology โ Security Techniques โ Information Security for Supplier Relationships
๐ The BS ISO/IEC 27036 series is an important member of the ISO/IEC 27000 information security management standard family, adopted identically in the UK. It specifically addresses information security in supplier relationships, helping customers and suppliers identify and manage information security risks in information exchange, product and service development and delivery, the ICT supply chain, and cloud service use. BSI Technical Committee IST/33 (IT โ Security techniques) is responsible for UK participation, classified under ICS 35.040. This article presents the series as a whole: the positioning of each part, key technical requirements, and practical application.
โ ๏ธ Suppliers (third parties) are among the most significant blind spots in enterprise information security risk management: a substantial share of data breaches involves supply chain partners or service providers. ISO/IEC 27036 was developed precisely to fill this governance gap.
1. Series Overview ๐
The ISO/IEC 27036 series defines the terminology, concepts, requirements, and guidance for “information security in supplier relationships”, covering relationship types from traditional product and service procurement through the ICT supply chain to cloud services. The parts were published in different years but build on one another to form a complete supplier security governance framework:
| Part | Edition | Subject | Main Content |
|---|---|---|---|
| BS ISO/IEC 27036-1 | 2014 | Part 1: Overview and concepts | Defines the problem domain and key concepts: types of supplier relationships, sources of information security risk, and the relationship to other 27000 family standards. |
| BS ISO/IEC 27036-2 | 2014 | Part 2: Requirements | Specifies information security requirements in supplier relationship management, including agreement processes, lifecycle management, security responsibilities, and monitoring and review. |
| BS ISO/IEC 27036-3 | 2013 | Part 3: Guidelines for ICT supply chain security | Guidance for the information and communication technology supply chain across product development, procurement, delivery, and maintenance. |
| BS ISO/IEC 27036-4 | 2016 | Part 4: Guidelines for security of cloud services | Guidance for supplier relationship information security when using cloud services (scan version; written from public domain knowledge). |
๐ก Part 4 (27036-4:2016) is a scan-only file in the source material; its details are summarised from public domain knowledge. Always use the official BSI published version for procurement and compliance work.
2. Core Concepts and Framework ๐งฉ
Part 1 (Overview and concepts) establishes the foundation of the series. It analyses the motives for establishing supplier relationships and classifies them into types: product/service supply, business process outsourcing, ICT supply chain, and cloud service relationships. For each type it identifies characteristic information security risk sources โ for example, excessive exposure of shared information, malicious functionality injected into supply chain components, service interruption, and cross-border data and compliance conflicts.
Part 2 (Requirements) is the compliance-oriented part of the series. It specifies information security requirements across the phases of supplier relationship management: supplier selection and risk assessment, information security clauses in agreements (contracts), and monitoring, review, change management, and termination during operation. Its requirements link to the control framework of ISO/IEC 27001/27002 and can serve as an extension for certification audits.
| Supplier Relationship Type | Typical Scenario | Main Risks | Relevant Part |
|---|---|---|---|
| Product/service supply | Procuring hardware/software, outsourcing development | IP leakage, malicious components, delivery quality | 27036-1, -2 |
| ICT supply chain | ICT product design, manufacturing, distribution chain | Supply chain injection, uncontrolled sources | 27036-3 |
| Cloud services | Using SaaS/PaaS/IaaS | Data sovereignty, multi-tenant isolation, dependency | 27036-4 |
| Business process outsourcing | IT operations, helpdesk, and other outsourced processes | Boundary of responsibility, continuity capability | 27036-1, -2 |
3. Key Technical Requirements ๐ง
- Agreement processes: make security responsibilities, data protection obligations, incident reporting mechanisms, audit rights, and breach liability explicit in contracts, turning security requirements into enforceable and accountable terms.
- Risk assessment up front: conduct information security risk assessment before selecting a supplier, assessing their ISMS, controls, and security history.
- Lifecycle management: carry information security requirements through the whole supplier relationship lifecycle โ admission, operation, change, exit, and data destruction.
- ICT supply chain defence in depth: control component sources, supply chain nodes, and the software supply chain (including open-source dependencies) to prevent upstream contamination of downstream products.
- Cloud service governance: clarify the shared responsibility model and cross-border data and compliance requirements under the chosen cloud service and deployment models.
4. Engineering Practice ๐ ๏ธ
- ๐ Supplier admission: embed ISO/IEC 27036 requirements into supplier due diligence and admission questionnaires, preferring suppliers with mature ISMS.
- ๐ Contracts and SLAs: fix information security clauses, incident response timelines, audit rights, and compliance terms in procurement contracts and service level agreements.
- ๐ Supply chain management: apply tiered management to critical ICT suppliers, with periodic security assessments, penetration tests, and supply disruption exercises.
- โ๏ธ Cloud security: define the cloud security responsibility boundary per 27036-4, establish cloud configuration baselines, access control, and data protection policies, alongside cloud security standards such as ISO/IEC 27017.
- ๐ Audit and improvement: include supplier information security in internal and third-party audits, with continuous monitoring and improvement.
๐จ Never treat supplier information security as merely “contract text”. Several major recent breaches resulted from compromised third-party operations accounts or contaminated supply chain software; supplier security requirements must be converted into verifiable controls and continuous monitoring.
5. Frequently Asked Questions โ
โ Q: What is the relationship between ISO/IEC 27036 and ISO/IEC 27001?
A: ISO/IEC 27001 is the certification standard for an Information Security Management System (ISMS), providing the overall framework for managing information security in an organisation. ISO/IEC 27036 is a dedicated series within the 27000 family focused on supplier relationships, offering supplementary requirements and guidance that connect to the ISMS.
A: ISO/IEC 27001 is the certification standard for an Information Security Management System (ISMS), providing the overall framework for managing information security in an organisation. ISO/IEC 27036 is a dedicated series within the 27000 family focused on supplier relationships, offering supplementary requirements and guidance that connect to the ISMS.
โ Q: What does 27036-3 (ICT supply chain security) primarily address?
A: The ICT supply chain involves successive layers of hardware, software, firmware, and services. This part provides guidance for identifying, assessing, and controlling information security threats in the supply chain, such as malicious code injection, component substitution, and supply chain interruption.
A: The ICT supply chain involves successive layers of hardware, software, firmware, and services. This part provides guidance for identifying, assessing, and controlling information security threats in the supply chain, such as malicious code injection, component substitution, and supply chain interruption.
โ Q: How should this series be applied when using cloud services?
A: Together with Part 4 and standards such as ISO/IEC 27017 (cloud security controls) and ISO/IEC 27018 (personal data protection), define the responsibility boundary between the cloud provider and customer, and put data security, access control, and incident management requirements into contracts with continuous monitoring.
A: Together with Part 4 and standards such as ISO/IEC 27017 (cloud security controls) and ISO/IEC 27018 (personal data protection), define the responsibility boundary between the cloud provider and customer, and put data security, access control, and incident management requirements into contracts with continuous monitoring.
โ Q: Can an SME apply only part of this series?
A: Yes. The standard permits scoping and tailoring by risk and resources: first identify critical suppliers and high-risk relationships, prioritise the Part 2 requirements relevant to you, then expand gradually.
A: Yes. The standard permits scoping and tailoring by risk and resources: first identify critical suppliers and high-risk relationships, prioritise the Part 2 requirements relevant to you, then expand gradually.