National foreword

This British Standard is the UK implementation of ISO/IEC 27036‑1:2021. It supersedes BS ISO/IEC 27036‑1:2014, which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee IST/33, Information security, cybersecurity and privacy protection.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2021.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

ISO/IEC 27036‑1 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, Information security, cybersecurity, and privacy protection.

This second edition cancels and replaces the first edition (ISO/IEC 27036‑1:2014), of which this constitutes a minor revision.

The main changes compared to the previous edition are as follows:

change of title;
revision of Clause 2;
alignment with drafting rules;
ISO/IEC 27036 (all parts) added in Bibliography.

A list of all parts in the ISO/IEC 27036 series can be found on the ISO website

Introduction

Most (if not all) organizations around the world, whatever their size or domains of activities, have relationships with suppliers of different kinds that deliver products or services.

Such suppliers can have either a direct or indirect access to the information and information systems of the acquirer, or will provide elements (software, hardware, processes, or human resources) that will be involved in information processing. Acquirers can also have physical and logical access to the information of the supplier when they control or monitor production and delivery processes of the supplier.

Thus, acquirers and suppliers can cause information security risks to each other. These risks need to be assessed and treated by both acquirer and supplier organizations through appropriate management of information security and the implementation of relevant controls. In many instances, organizations have adopted ISO/IEC 27001 and ISO/IEC 27002 for the management of their information security. Such International Standards should also be adopted in managing supplier relationships in order to effectively control the information security risks inherent in those relationships.

This document provides further detailed implementation guidance on the controls dealing with supplier relationships that are described as general recommendations in ISO/IEC 27002.

Supplier relationships in the context of this document include any supplier relationship that can have information security implications, e.g. information technology, healthcare services, janitorial services, consulting services, R&D partnerships, outsourced applications (ASPs), or cloud computing services (such as software, platform, or infrastructure as a service).

Both the supplier and acquirer should take responsibility for achieving the objectives in the supplier-acquirer relationship and adequately addressing the information security risks that can occur. It is expected that they implement the requirements and guidelines of this document. Furthermore, fundamental processes should be implemented to support the supplier-acquirer relationship (e.g. governance, business management, and operational and human resources management). These processes will provide support in terms of information security as well as the accomplishment of business objectives.

1 Scope

This document is an introductory part of ISO/IEC 27036. It provides an overview of the guidance intended to assist organizations in securing their information and information systems within the context of supplier relationships. It also introduces concepts that are described in detail in the other parts of ISO/IEC 27036. This document addresses perspectives of both acquirers and suppliers.

2 Normative references

3 Terms and definitions

4 Symbols and abbreviated terms

5 Problem definition and key concepts

5.1 Motives for establishing supplier relationships

5.2 Types of supplier relationships

5.3 Information security risks in supplier relationships and associated threats

5.4 Managing information security risks in supplier relationships

5.5 ICT supply chain considerations

6 Overall ISO/IEC 27036 structure and overview

6.1 Purpose and structure

6.2 Overview of ISO/IEC 27036‑1: Overview and concepts

6.3 Overview of ISO/IEC 27036‑2: Requirements

6.4 Overview of ISO/IEC 27036‑3: Guidelines for information and communication technology (ICT) supply chain security

6.5 Overview of ISO/IEC 27036‑4: Guidelines for security of cloud services

Bibliography

BS ISO/IEC 27036-1:2021

Cybersecurity. Supplier relationships - Overview and concepts

Current

Published:

31 Oct 2021