ISO/IEC 27036-2:2014
(Main)Information technology — Security techniques — Information security for supplier relationships — Part 2: Requirements
Information technology — Security techniques — Information security for supplier relationships — Part 2: Requirements
ISO/IEC 27036-2:2014 specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships. These requirements cover any procurement and supply of products and services, such as manufacturing or assembly, business process procurement, software and hardware components, knowledge process procurement, Build-Operate-Transfer and cloud computing services. These requirements are intended to be applicable to all organizations, regardless of type, size and nature. To meet these requirements, an organization should have already internally implemented a number of foundational processes, or be actively planning to do so. These processes include, but are not limited to, the following: governance, business management, risk management, operational and human resources management, and information security.
Technologies de l'information — Techniques de sécurité — Sécurité d'information pour la relation avec le fournisseur — Partie 2: Exigences
General Information
Relations
Related Packages
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 27036-2
First edition
2014-08-01
Information technology — Security
techniques — Information security for
supplier relationships —
Part 2:
Requirements
Technologies de l’information — Techniques de sécurité — Sécurité
d’information pour la relation avec le fournisseur —
Partie 2: Exigences
Reference number
ISO/IEC 27036-2:2014(E)
©
ISO/IEC 2014
---------------------- Page: 1 ----------------------
ISO/IEC 27036-2:2014(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2014
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2014 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27036-2:2014(E)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 1
5 Structure of ISO/IEC 27036-2 . 2
6 Information security in supplier relationship management . 4
6.1 Agreement processes . 4
6.2 Organisational project-enabling processes . 7
6.3 Project processes .10
6.4 Technical processes .14
7 Information security in a supplier relationship instance .15
7.1 Supplier relationship planning process.15
7.2 Supplier selection process .17
7.3 Supplier relationship agreement process .21
7.4 Supplier relationship management process .24
7.5 Supplier relationship termination process .27
Annex A (informative) Cross-references between ISO/IEC 15288 clauses and ISO/
IEC 27036-2 clauses .30
Annex B (informative) Cross-references between ISO/IEC 27036-2 clauses and ISO/
IEC 27002 controls .32
Annex C (informative) Objectives from Clauses 6 and 7 .34
Bibliography .38
© ISO/IEC 2014 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 27036-2:2014(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
Details of any patent rights identified during the development of the document will be in the Introduction
and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical Barriers
to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT Security
techniques.
ISO/IEC 27036 consists of the following parts, under the general title Information technology — Security
techniques — Information security for supplier relationships:
— Part 1: Overview and concepts
— Part 2: Requirements
— Part 3: Guidelines for information and communication technology supply chain security
The following part is under preparation:
— Part 4: Guidelines for security of cloud services.
iv © ISO/IEC 2014 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27036-2:2014(E)
Introduction
Organizations throughout the world work with suppliers to acquire products and services. Many
organizations establish several supplier relationships to cover a variety of business needs, such as
operations or manufacturing. Conversely, suppliers provide products and services to several acquirers.
Relationships between acquirers and suppliers established for the purpose of acquiring a variety of
products and services may introduce information security risks to both acquirers and suppliers. These
risks are caused by mutual access to the other party’s assets, such as information and information
systems, as well as by the difference in business objectives and information security approaches. These
risks should be managed by both acquirers and suppliers.
ISO/IEC 27036-2:
a) specifies fundamental information security requirements for defining, implementing, operating,
monitoring, reviewing, maintaining and improving supplier and acquirer relationships;
b) facilitates mutual understanding of the other party’s approach to information security and tolerance
for information security risks;
c) reflects the complexity of managing risks that can have information security impacts in supplier
and acquirer relationships;
d) is intended to be used by any organization willing to evaluate the information security in supplier
or acquirer relationships;
e) is not intended for certification purposes;
f) is intended to be used to set a number of defined information security objectives applicable to a
supplier and acquirer relationship that is a basis for assurance purposes.
ISO/IEC 27036-1 provides overview and concepts associated with information security in supplier
relationships.
ISO/IEC 27036-3 provides guidelines to the acquirer and the supplier for managing information security
risks specific to the ICT products and services supply chain.
ISO/IEC 27036-4 (to be published) provides guidelines to the acquirer and the supplier for managing
information security risks specific to the cloud services.
NOTE The user of this document needs to correctly interpret each of the forms of the expression of provisions
(e.g. “shall”, “shall not”, “should” and “should not”) as being either requirements to be satisfied or recommendations
where there is a certain freedom of choice.
© ISO/IEC 2014 – All rights reserved v
---------------------- Page: 5 ----------------------
INTERNATIONAL STANDARD ISO/IEC 27036-2:2014(E)
Information technology — Security techniques —
Information security for supplier relationships —
Part 2:
Requirements
1 Scope
This part of ISO/IEC 27036 specifies fundamental information security requirements for defining,
implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer
relationships.
These requirements cover any procurement and supply of products and services, such as manufacturing
or assembly, business process procurement, software and hardware components, knowledge process
procurement, Build-Operate-Transfer and cloud computing services.
These requirements are intended to be applicable to all organizations, regardless of type, size and
nature.
To meet these requirements, an organization should have already internally implemented a number of
foundational processes, or be actively planning to do so. These processes include, but are not limited to,
the following: governance, business management, risk management, operational and human resources
management, and information security.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
ISO/IEC 27036-1, Information technology — Security techniques — Information security for supplier
relationships — Part 1: Overview and concepts
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 and ISO/IEC 27036-
1 apply.
4 Symbols and abbreviated terms
The following symbols (and abbreviated terms) are used in this standard:
ASP Application Service Provider
BCP Business Continuity Plan
DBA Database Administrator
© ISO/IEC 2014 – All rights reserved 1
---------------------- Page: 6 ----------------------
ISO/IEC 27036-2:2014(E)
ICT Information and Communication Technology
ISMS Information Security Management System
ITT Invitation to Tender
RFP Request for Proposal
VoIP Voice over IP
5 Structure of ISO/IEC 27036-2
Clause 6 defines fundamental and high-level information security requirements applicable to the
management of several supplier relationships. Any of the processes in Clause 6 can be applied to
individual supplier relationships at any point in that supplier relationship lifecycle.
[1]
These requirements are structured according to life cycle processes specified in ISO/IEC 15288. These
requirements shall be applied by the acquirer and by the supplier to ensure that these organisations are
able to manage information security risks resulting from supplier relationships.
NOTE Clause 6 only references the ISO/IEC 15288 life cycle processes that are relevant to information
security in supplier relationships.
Clause 7 defines fundamental information security requirements applicable to an acquirer and a supplier
within a context of a single supplier relationship instance.
These requirements are structured given following supplier relationship life cycle processes:
a) Supplier relationship planning process;
b) Supplier selection process;
c) Supplier relationship agreement process;
d) Supplier relationship management process;
e) Supplier relationship termination process.
Requirements in Clause 7 shall be applied by the acquirer and the supplier involved in a supplier
relationship to ensure that these organisations are able to manage relevant information security risks.
Figure 1 describes the scope of the fundamental information security requirements in connection with
processes defined in Clauses 6 and 7:
2 © ISO/IEC 2014 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC 27036-2:2014(E)
Scope
6.1 Agreement processes
6.1.1 Acquisition 6.1.2 Supply process
process
6.2 Organisational project-enabling processes
6.2.1 Life cycle model 6.2.2 Infrastructure 6.2.3 Project portfolio
management process
management process management process
6.2.4 Human 6.2.5 Quality
resource
management
management process
process
Fundamental and high-
level information security
requirements for
acquirers and suppliers
6.3 Project processes
as organizational
6.3.1 Project planning 6.3.2 Project 6.3.3 Decision
scheme commonly
process assessment and management process
applicable to instances
control process
of supplier relationship.
6.3.4 Risk 6.3.5 Configuration 6.3.6 Information
management process management process management process
6.3.7 Measurement
process
6.4 Technical processes
6.4.1 Architectural
design process
7.1 Supplier 7.2 Supplier selection 7.3 Supplier
Fundamental information
relationship planning process relationship
security requirements for
process agreement process
acquirers and suppliers
when establishing and
7.4 Supplier 7.5 Supplier
maintaining an instance
relationship relationship
of supplier relationship.
management process termination process
Figure 1 — Scope of fundamental information security requirements defined in Clauses 6 and 7
© ISO/IEC 2014 – All rights reserved 3
---------------------- Page: 8 ----------------------
ISO/IEC 27036-2:2014(E)
Text of Clauses 6.1 to 6.4, and of Clauses 7.1 to 7.5 is structured in tables which need to be interpreted
as follows:
Acquirer
Text specific to the acquirer.
Supplier
Text specific to the supplier.
Acquirer Supplier
Text specific to both acquirer and supplier, unless explicitly stated.
Text specific to the acquirer. Text specific to the supplier.
There are three informative annexes.
Annex A provides cross-references between clauses of ISO/IEC 15288 that are relevant to supplier
relationships and clauses of ISO/IEC 27036-2.
Annex B provides cross-references between clauses of ISO/IEC 27036-2 and information security
[2]
controls listed in ISO/IEC 27002 and that are relevant to supplier relationships.
Annex C provides lists of objectives that are stated in Clauses 6 and 7 for the acquirer and supplier.
6 Information security in supplier relationship management
6.1 Agreement processes
Organisations can enter into a variety of supplier relationships. Suitable relationships between acquirers
and suppliers are achieved using agreements defining information security roles and responsibilities
with respect to the supplier relationship.
The following agreement processes support procurement or supply of a product or service from both
strategic and information security perspectives:
a) Acquisition process;
b) Supply process.
6.1.1 Acquisition process
6.1.1.1 Objective
The following objective shall be met by the acquirer for successfully managing information security
within the acquisition process:
Acquirer
a) Establish a supplier relationship strategy that:
1) Is based on the information security risk tolerance of the acquirer;
2) Defines the information security foundation to use when planning, preparing, managing and
terminating the procurement of a product or service.
4 © ISO/IEC 2014 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC 27036-2:2014(E)
6.1.1.2 Activities
The following minimum activities shall be executed by the acquirer to meet the objective defined at
Clause 6.1.1.1:
Acquirer
a) Define, implement, maintain and improve a supplier relationship strategy containing the follow-
ing:
1) Management motives, needs and expectations from procuring products or services;
NOTE These statements should be expressed from business, operational, legal and regula-
tory perspectives.
2) Management commitment to allocate necessary resources;
3) An information security risk management framework to use for assessing information secu-
rity risks accompanying the procurement of a product or service;
NOTE Clause 6.3.4 defines information security requirements for the establishment of an
information security risk management framework.
4) A framework to use when defining information security requirements during the supplier
relationship planning process;
This framework shall be defined following information security guidelines and rules, such as
information security policy and information classification, established by the acquirer.
Information security requirements defined in this framework need to be customized to each
supplier relationship instance, considering type and nature of the product or service that is
procured.
This framework shall also include the following:
i) Methods for suppliers to provide evidence for adherence to the defined information
security requirements;
ii) Methods for the acquirer to validate suppliers’ adherence to the defined information
security requirements;
iii) Processes for sharing information about information security changes, incidents and
other relevant events among the acquirer and suppliers.
5) A supplier selection criteria framework to use when selecting a supplier and which includes
the following:
i) Methods for assessing the information security maturity required from a supplier;
The following elements can be requested from the supplier to evaluate its information
security maturity:
1. Past security-relevant performance;
2. Evidence of pro-active management of information security (e.g. holding an ISO/
IEC 27001 certification relevant to the supply of the product or service);
3. Evidence of documented and tested business continuity and ICT continuity plans.
ii) Methods to be used for assessing evidence provided by a supplier based on the defined
information security requirements;
iii) Methods for assessing supplier acceptance of the following:
1. Information security requirements defined in the supplier relationship plan;
2. Commitment to support the acquirer in its compliance monitoring and enforcement
activities;
3. Transition of the product or service supply that may be procured when it has been
previously manufactured or operated by the acquirer or by a different supplier;
© ISO/IEC 2014 – All rights reserved 5
---------------------- Page: 10 ----------------------
ISO/IEC 27036-2:2014(E)
4. Termination of the product or service supply.
iv) Supplier-specific requirements, to be defined in accordance to business, legal, regula-
tory, architectural, policy and contractual expectations from the acquirer, such as:
1. Financial strength of the supplier for being able to supply the product or service;
2. Location of the supplier and from which the product or service will be supplied to
particularly reduce the risk of legal and regulatory breaches.
6) High-level information security requirements to use when defining the following:
i) Transition plan to transfer a product or service procured to a different supplier;
ii) Information security change management procedure;
iii) Information security incident management procedure;
iv) Compliance monitoring and enforcement plan;
v) Termination plan to terminate the procurement of a product or service.
b) Appoint an individual responsible for handling the information security aspects of the supplier
relationship strategy and ensure that this individual is appropriately and regularly trained.
c) Ensure the supplier relationship strategy is reviewed at least once a year and whenever signifi-
cant business, legal, regulatory, architectural, policy and contractual changes occur.
NOTE The supplier relationship strategy should also be reviewed when a product or service is
procured that can significantly impact the acquirer.
6.1.2 Supply process
6.1.2.1 Objective
The following objective shall be met by the supplier for successfully managing information security
within the supply process:
Supplier
a) Establish an acquirer relationship strategy that
1) Is based on the information security risk tolerance of the supplier;
2) Defines the information security foundation to use when planning, preparing, managing and
terminating the supply of a product or service.
6.1.2.2 Activities
The following minimum activities shall be executed by the supplier to meet the objective defined at
Clause 6.1.2.1:
Supplier
a) Define, implement, maintain and improve an acquirer relationship strategy containing the follow-
ing:
1) Management motives, needs and expectations from supplying of products or services;
NOTE These statements should be expressed from business, operational, and legal perspec-
tives.
2) Management commitment to allocate necessary resources;
3) An information security risk management framework to use for assessing information secu-
rity risks that accompany the supply of a product or a service;
NOTE Clause 6.3.4 defines information security requirements for the establishment of an
information security risk management framework.
6 © ISO/IEC 2014 – All rights reserved
---------------------- Page: 11 ----------------------
ISO/IEC 27036-2:2014(E)
4) An information security management framework by:
i) Defining, implementing, maintaining and improving an information security manage-
ment within the organization;
NOTE An ISMS establishment based on ISO/IEC 27001 can serve to ensure adequate
information security management within the organization and to demonstrate its level
to acquirers.
ii) Ensuring that information security requirements stated in existing acquirer tender
documents and supplier relationship agreements have been identified for ensuring the
supplier information security conformity to these requirements;
Any gap shall be addressed to satisfy acquirer’s information security requirements of
existing supplier relationship agreements.
iii) Defining a process to accept, interpret, apply and measure acquirer information secu-
rity requirements.
5) Methods for:
i) Demonstrating supplier’s capacity to supply a product or service of acceptable quality;
ii) Providing evidence of adherence to information security requirements defined by
acquirers.
6) High-level information security requirements to use when defining the following:
i) Transition plan to support the transfer of a product or service supply when it has been
previously manufactured or operated by an acquirer or by another supplier;
ii) Information security change management procedure;
iii) Information security incident management procedure;
iv) Processes for sharing information about information security changes, incidents and
other relevant events among the supplier and acquirers;
v) Process for handling corrective actions;
vi) Termination plan to terminate the supply of a product or service.
b) Appoint an individual responsible for handling the information security aspects of the acquirer
relationship strategy and ensure that this individual is appropriately and regularly trained.
c) Ensure the acquirer relationship strategy is reviewed at least once a year and whenever signifi-
cant business, legal, regulatory, architectural, policy and contractual changes occur.
NOTE The acquirer relationship strategy should also be reviewed when a supplier relationship
is established that can significantly impact the supplier.
6.2 Organisational project-enabling processes
The organisational project-enabling processes are concerned with ensuring that the resources, such as
the financial ones, needed to enable the project to meet the needs and expectations of the organization’s
interested parties are met.
In particular, following organisational project-enabling processes support the establishment of the
environment in which supplier relationships are conducted or planned:
a) Life cycle model management process;
b) Infrastructure management process;
c) Project portfolio management process;
d) Human resource management process;
e) Quality management process.
© ISO/IEC 2014 – All rights reserved 7
---------------------- Page: 12 ----------------------
ISO/IEC 27036-2:2014(E)
6.2.1 Life cycle model management process
Acquirer Supplier
a) The acquirer and the supplier shall establish the life cycle model management process when man-
aging information security in supplier relationships.
NOTE The purpose of this process is to define, maintain, and ensure availability of policies,
life cycle processes, life cycle models, and procedures for use by the organization. There are no
specific information security requirements and recommendations for acquirers or suppliers to
consider when internally establishing this process.
6.2.2 Infrastructure management process
6.2.2.1 Objective
The following objective shall be met by each of the following organisations for successfully managing
information security within the infrastructure management process:
Acquirer Supplier
a) Provide the enabling infrastructure to support the organization in managing information secu-
rity within supplier relationships.
6.2.2.2 Activities
The following minimum activities shall be executed by each of the following organisations to meet the
objective defined at Clause 6.2.2.1:
Acquirer Supplier
a) Define, implement, maintain and improve physical and logical security infrastructure capabilities
for protecting acquirer’s or supplier’s assets, such as information and information systems; and
b) Define, implement, maintain and improve contingency arrangements to ensure that the procure-
ment or the supply of a product or service can continue in the event of its disruption caused by
natural or man-made causes.
These arrangements should be based on information security risk assessments and associ-
ated treatment plans resulting from the procurement or the supply of a product or service, and
include:
1) The provision of alternative, secure facilities for the product or service supply to continue;
2) Escrow of information and proprietary technologies, such as application source code and
cryptographic keys, using a trusted third party;
3) Recovery arrangements to ensure continued availability of information stored at subcontrac-
tor premises; and
NOTE These arrangements should only be considered when the supplier supplies services
to an acquirer.
4) Alignment with business continuity constraints expressed by an acquirer or supplier.
NOTE The following International Standards provide requirements and guidelines on con-
tingency arrangements:
[3]
1. ISO/IEC 27031
[4]
2. ISO 22313
[5]
3. ISO 22301
8 © ISO/IEC 2014 – All rights reserved
---------------------- Page: 13 ----------------------
ISO/IEC 27036-2:2014(E)
6.2.3 Project portfolio management process
6.2.3.1 Objective
The following objective shall be met by each of the following organisations for successfully managing
information security within the project portfolio management process:
Acquirer Supplier
a) Establish a process for considering information security and overall business mission implica-
tions and dependencies for each individual project for those projects where suppliers or acquir-
ers are involved.
6.2.3.2 Activities
The following minimum activities shall be executed by each of the following organisations to meet the
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.