Standards and frameworks · Supply chain

ISO/IEC 27036 Cybersecurity – Supplier relationships

PublishedPaid · 13 June 2023

Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.

Summary

The series explains how to manage information security in supplier relationships, from the point of view of both those who buy and those who supply products and services. Part 1 introduces concepts and risks, part 2 sets requirements for the whole relationship lifecycle (selection, contract, management, review and termination), part 3 deals with the hardware, software and services supply chain, including visibility over multi-tier suppliers and building security into development processes, and part 4 with acquiring and providing cloud services. It is a reference for the supply chain security measures required by NIS2 and for the ICT third-party risk management required by DORA.

Reference

ISO/IEC 27036

Official title

Cybersecurity – Supplier relationships

Body

ISO / IEC – Technical committee: ISO/IEC JTC 1/SC 27

Type

Series of standards

Status

Published

Published

13 June 2023

Access to the text

Paid

Sectors

• Supply chain
• Governance and coordination

Notes

Part 2 is the only one containing requirements; the others are guidelines. Part 1 has been under systematic review since July 2026 and part 4 was confirmed in 2022 (secondary source: ISO project data shown in the Genorma catalogue). The main link leads to part 3 in the IEC catalogue.

Last verified

2 November 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)