ISO 27036 Explained: What the Four Parts Cover

ISO/IEC 27036 is a four-part international standard that sets out how acquirers and suppliers should manage information security risk across their relationship, from contract to offboarding. It does not certify a company's overall security posture, and reading only the cyber angle misses why it matters for vendor risk programs.

What Is ISO 27036?

ISO/IEC 27036 is the ISO standard for information security in supplier relationships. It covers four parts: Part 1 (concepts, second edition 2021), Part 2 (requirements, second edition 2022), Part 3 (ICT supply chain security guidelines, second edition 2023), and Part 4 (cloud services guidelines, first edition 2016). Together they tell acquirers and suppliers how to assess, contract for, and monitor information security risk in a vendor relationship.

The series was published by ISO and IEC jointly. ISO's own catalog listing for Part 1 describes it as covering "the common information risks encountered in ICT supply chains" from the acquirer's point of view, and Part 3's listing frames the series around hardware, software, and services supply chain security specifically.

The Four Parts of ISO 27036, and Who Each One Is For

Most explainers treat ISO 27036 as one document. It isn't. Each part targets a different reader and a different decision.

Part 2 is the one most vendor risk teams actually need, and it is explicitly not written for certification. There is no "ISO 27036 certified" badge a vendor can earn the way they can for ISO 27001. If a vendor claims ISO 27036 certification, that claim does not hold up against what the standard itself says about its own scope.

Is ISO 27036 the Same as ISO 27001?

No. ISO 27001 certifies an organization's overall information security management system. ISO 27036 is guidance for managing risk in a specific supplier relationship, and it is not certifiable. A vendor can hold ISO 27001 certification and still create ISO 27036-relevant risk if the relationship itself, the data flows, the subcontracting chain, isn't governed the way Part 2 describes. Teams that treat an ISO 27001 badge as proof the vendor relationship is covered are checking the wrong box.

Where ISO 27036 Stops, and Why That Gap Matters

ISO 27036 is a cybersecurity standard. It governs how information security risk gets managed in a supplier relationship: access controls, data handling, incident notification, subcontractor obligations. It says nothing about whether the supplier will still be solvent in 18 months.

That gap is where most TPRM programs fail. Tools built around ISO 27036-style controls, including UpGuard, SecurityScorecard, BitSight, SAFE Security, and Panorays, score a vendor's external attack surface and security hygiene. That is real, useful work, and it maps closely to what Part 3 asks for. But a vendor can pass every control in that framework and still file for Chapter 11 eight months later, because none of those signals touch the balance sheet. Credit Pulse's position is that a TPRM program built only on cyber-control frameworks like ISO 27036 covers one risk surface and leaves the one that kills vendor relationships, financial failure, sitting unmonitored.

This is the same reason annual questionnaires built around these standards are a lagging indicator. A vendor can answer every ISO 27036-aligned question correctly in March and be insolvent by October. The control framework doesn't change; the company behind it does. Continuous monitoring on financial signals catches that shift months before a renewal cycle would.

How to Use ISO 27036 in a Vendor Risk Program

1. Start with Part 1 to get acquirer and supplier speaking the same vocabulary before you write anything into a contract.
2. Pull specific clauses from Part 2 into supplier contracts rather than citing the standard by name. "Complies with ISO 27036" is not an enforceable contract term; a specific access-control or notification clause is.
3. Apply Part 3 to your highest-exposure ICT suppliers, the ones embedded in your software or hardware supply chain, not every vendor on your list.
4. Apply Part 4 only to cloud vendors, and remember it explicitly excludes business continuity planning, so pair it with your own continuity requirements.
5. Layer a financial-risk check on top, before and between review cycles, since nothing in the standard covers solvency.

Credit Pulse's research agents run that fifth step continuously instead of on an annual calendar, which is the layer most TPRM programs built around cyber frameworks like this one are missing.

For teams building a broader third-party risk program, start with our third-party risk management guide, which covers program structure beyond the ISO framework. If you're comparing software for the cyber-control side specifically, see our breakdown of TPRM software platforms. And if financial risk monitoring is the piece your program is missing, our vendor financial risk page covers how continuous monitoring fills that gap.

Frequently Asked Questions

What are the four parts of ISO 27036?

Part 1 covers overview and concepts (2021), Part 2 covers requirements (2022), Part 3 covers ICT supply chain security guidelines (2023), and Part 4 covers cloud services guidelines (2016, confirmed unchanged in 2022).

Is ISO 27036 the same as ISO 27001?

No. ISO 27001 certifies an organization's information security management system. ISO 27036 provides guidance for managing risk in supplier relationships specifically, and it is not a certifiable standard.

Can a vendor be ISO 27036 certified?

No. Part 2, the requirements section, is explicitly not intended for certification. A vendor claiming "ISO 27036 certification" is describing something the standard itself does not offer.

Does ISO 27036 cover financial or solvency risk?

No. ISO 27036 is a cybersecurity and information-risk standard. It does not address a supplier's financial stability, which is why programs built only around it miss the risk that most often ends a vendor relationship.

How does ISO 27036 relate to TPRM software?

Most TPRM and cyber-rating platforms, including UpGuard, SecurityScorecard, BitSight, SAFE Security, and Panorays, operationalize the kind of control assessment ISO 27036 describes. They cover the cybersecurity layer of third-party risk but not the financial layer.