ISO/IEC 27036-1:2021

ISO/IEC 27036-1:2021 is the overview and concepts part of the supplier-relationships series, the implementation guidance behind the supplier controls of ISO/IEC 27002. Clause 5 sets out why organizations use suppliers, the types of relationship (products, services with the location-dependent access patterns of Table 2, the ICT supply chain of successive acquirer and supplier tiers, cloud computing as a multi-supplier and multi-tenant relationship), the information security risks and threats of supplier relationships (shared responsibility, absent or weak management, insufficient communication, geographic and cultural differences, product risks of security function, quality, IP, authenticity and warranty), how both parties assess and treat those risks with access, quality and assurance controls written into the agreement and with transparency or, failing that, selection criteria, and the ICT supply chain considerations (acceptance criteria, an organization-wide acquisition system with requirements, pre-acquisition risk assessment, negotiated agreements with audit rights and continuous monitoring). Clause 6 explains the series: part 2 requirements, part 3 ICT supply chain guidance, part 4 cloud service guidance. Guidance, not certifiable.