ISO/IEC 27036 (Cybersecurity — Supplier relationships), explained

ISO/IEC 27036, "Cybersecurity — Supplier relationships," is a four-part International Standard from ISO/IEC JTC 1/SC 27 that tells an acquirer and a supplier how to manage the information security risk that sits between them — not inside either organization's own network, but in the handoffs, contracts and shared visibility of the relationship itself. Published across four separately-dated parts (2021, 2022, 2023 and 2016), it is one of the few ISO/IEC standards that names software bill of materials (SBoM) as a defined term in its own text, making it directly relevant to anyone already building SBOM and supply-chain-risk practices around firmware.

What the four parts actually cover

Part	Title	Current edition	Published	What it is
Part 1	Overview and concepts	2nd edition	September 2021	Introductory: shared vocabulary and concepts, plus a guided tour of what Parts 2-4 each cover
Part 2	Requirements	2nd edition	June 2022	The only part with "shall"-level requirements, for defining, implementing, operating, monitoring, reviewing, maintaining and improving acquirer/supplier relationships
Part 3	Guidelines for hardware, software, and services supply chain security	2nd edition	June 2023	Guidance on gaining visibility into multi-layered, physically dispersed supply chains, responding to the risks they create, and integrating security into system/software life cycle processes
Part 4	Guidelines for security of cloud services	1st edition	October 2016	Guidance for cloud service customers and providers; assumes Parts 1-3 are already being followed

Per Part 1's own Clause 1 scope text: it "is an introductory part of ISO/IEC 27036. It provides an overview of the guidance intended to assist organizations in securing their information and information systems within the context of supplier relationships. It also introduces concepts that are described in detail in the other parts of ISO/IEC 27036. This document addresses perspectives of both acquirers and suppliers."

Requirements vs. guidance: why Part 2 is different

Part 2 is the family's only requirements document. Secondary summaries describe its requirements as ones an organization can build directly into an ISO/IEC 27001 information security management system, assessed alongside that certification. This guide has not independently verified that certification mechanism against ISO/IEC 27001's own clause text, so treat the precise assessment pathway as to be confirmed rather than assumed — what is confirmed, from Part 2's own catalogue abstract, is that it "specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships," applicable to any organization "regardless of type, size and nature."

Parts 1, 3 and 4, by contrast, are guidance documents: they tell you how to think about and implement supplier-relationship security, but do not themselves set a pass/fail bar the way Part 2 does.

Part 3's scope, verbatim, and what it excludes

Part 3's own Clause 1 (Scope) states it provides guidance to acquirers and suppliers of hardware, software and services regarding:

1. "gaining visibility into and managing the information security risks caused by physically dispersed and multi-layered hardware, software, and services supply chains";
2. "responding to risks stemming from this physically dispersed and multi-layered hardware, software, and services supply chain that can have an information security impact on the organizations using these products and services"; and
3. "integrating information security processes and practices into the system and software life cycle processes, as described in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207, while supporting information security controls, as described in ISO/IEC 27002."

It explicitly excludes business continuity and resiliency ("ISO/IEC 27031 addresses" that separately). Part 3's Clause 3.1 defines software bill of materials (SBoM) as an "inventory of software components, sub-components and dependencies with associated information" — the same concept covered in depth in firmware SBOM: building one when you don't have the source, confirming that supply-chain visibility and SBOM practice sit squarely inside what Part 3 expects an organization to have.

A standard mid-revision: what changed, and what hasn't yet

ISO/IEC 27036 has gone through a staggered revision wave since 2021:

Part	Previous edition	Current edition	What changed
Part 1	2014	2021	Per its own foreword, a "minor revision": title change, a revised Clause 2, drafting-rule alignment, and the full ISO/IEC 27036 series added to the Bibliography
Part 2	2014	2022	Technical revision restating the fundamental requirements
Part 3	2013	2023	Technical revision that broadened the original "ICT supply chain" framing to hardware, software and services generally; structure realigned with the newest ISO/IEC/IEEE 15288; a former annex removed, a new one added
Part 4	—	2016 (unrevised)	No revision has been published since the original edition

One easy-to-miss inconsistency this creates: Part 1's own 2021 table of contents still describes Part 3, in its guided-tour section, as "Guidelines for information and communication technology (ICT) supply chain security" — Part 3's pre-2023 title and framing. Part 1 was finalized before Part 3's 2023 revision broadened that scope beyond ICT, so Part 1's internal description of Part 3 is, strictly, out of date relative to Part 3's current text. A presentation on the revision given at NIST's Software Supply Chain Assurance forum in September 2023 confirms the family was "undergoing the first round of revisions" at that time, with Part 4's own revision still pending a related change to ISO/IEC 27017.

How it fits with other security-by-design work

The same September 2023 presentation describes ISO/IEC 27036 as intentionally aligned with ISO/IEC/IEEE 15288 (systems and software engineering life cycle processes), with Part 2 and Part 3 each mapping their own additional requirements onto specific 15288 life cycle process clauses (agreement processes, technical management processes, technical processes). Part 3's own Clause 4 states plainly that its structure "is harmonized with ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207," and that it "is also harmonized with ISO/IEC 27002 and references relevant information security controls within the life cycle processes with the mapping provided in Annex A" — meaning a Part 3 implementation is designed to plug into controls your organization may already run under ISO/IEC 27002, not replace them.

For device and firmware makers, ISO/IEC 27036 sits alongside two other things SoftWSP guides already cover: NIST SP 800-161: Cybersecurity Supply Chain Risk Management (C-SCRM), which addresses the same supply-chain-trust question from a US federal standards perspective, and the EU Cyber Resilience Act's own supplier and component due-diligence duties — see CRA Annex I explained. None of the three substitute for each other; they overlap in the questions they ask about suppliers without being formally interchangeable.

A workable starting point

1. Start with Part 1 as a glossary, not a requirements document — it exists to give acquirer and supplier teams shared vocabulary before anyone reads Parts 2-4.
2. Treat Part 2 as the part worth building a management-system case around, if your organization already runs or is pursuing ISO/IEC 27001 certification; Parts 1, 3 and 4 inform practice without creating an assessable "shall" bar of their own.
3. Use Part 3's visibility-and-response framing to structure your component sourcing questions — "where did this come from, who touched it, and what happens if it's compromised" maps directly onto the SBOM and vendor-traceability work firmware teams already need for CRA and NIST C-SCRM.
4. Don't assume Part 4 reflects the current state of cloud-security guidance — it is the one part of the family that has not been revised since 2016, and its own scope says it depends on Parts 1-3 being followed first.
5. Check the current edition before citing a clause number — three of the four parts have been revised since 2021, and older citations (especially ones referencing the pre-2023 Part 3 as "ICT supply chain security") may point at superseded text.

SoftWSP's firmware and supply-chain assessments build the component-level visibility — SBOMs, known-vulnerability matching, vendor support history — that a Part 2 or Part 3 supplier-relationship program needs as evidence: see device & firmware security.

This guide summarises ISO's own published preview text of ISO/IEC 27036-1 and -3, their catalogue records, and independent secondary analysis of the standard; it is not a substitute for the purchased ISO/IEC text and does not constitute compliance or legal advice.