What is ISO 27036?
ISO/IEC 27036 is a multi-part international series of standards that describes how acquirers and suppliers manage information security throughout the entire supplier relationship, from planning and selection through contract and management to termination, including the security of the hardware, software and services supply chain and the use of cloud services. The series belongs to the ISO/IEC 27000 family and builds on the management system of ISO 27001. Since its 2021 revision, the series has carried the title Cybersecurity - Supplier relationships. For OT environments, ISO 27036 matters because system integrators, machine builders and maintenance contractors often have deep and long-lasting access to the plant.
ISO 27036 helps you manage cyber risks across suppliers, service providers, cloud providers and software developers, even when they in turn rely on subcontractors.
📦 What parts make up ISO 27036?
ISO 27036 consists of four parts. Parts 1 to 3 were revised between 2021 and 2023; Part 4 still dates from 2016.
| Part | Title | Current edition | First edition | Content |
|---|---|---|---|---|
| 27036-1 | Overview and concepts | 2021 | 2014 | Introduction, terminology, types of supplier relationships and their risks |
| 27036-2 | Requirements | 2022 | 2014 | Fundamental requirements for establishing, operating, monitoring and improving supplier relationships |
| 27036-3 | Guidelines for hardware, software and services supply chain security | 2023 | 2013 | Risks in multi-layered supply chains, such as tampered components and unknown subcontractors |
| 27036-4 | Guidelines for security of cloud services | 2016 | 2016 | Risks of cloud use for cloud customers and cloud service providers |
The series applies to every organisation, regardless of size or sector, and also where there is no commercial contract, for example when one subsidiary supplies another or when open-source software is used.
🧠 What do the requirements in Part 2 contain?
Part 2 is the normative core of the series. It assumes an organisation already has foundational processes for business management, risk management, human resources and information security, and on top of that describes the supplier relationship as a lifecycle:
- Planning - determine which information and systems a supplier touches and what risk that creates.
- Selection - assess candidate suppliers on their security maturity before you choose.
- Agreement - set down security requirements, reporting obligations and audit rights in the contract.
- Management - monitor compliance, manage changes and cooperate during incidents.
- Termination - revoke access, retrieve or destroy data and retain knowledge when the relationship ends.
Despite its title Requirements, there is no widely used accredited certification scheme for Part 2. In practice, auditors assess supplier management within an ISMS based on ISO 27001, with ISO 27036 providing the detail.
🔄 How does ISO 27036 relate to ISO 27001 and IEC 62443?
ISO 27001 requires you to control supplier risks; ISO 27036 explains how. In ISO 27002:2022, five controls deal with suppliers: 5.19 (information security in supplier relationships), 5.20 (addressing information security within supplier agreements), 5.21 (managing information security in the ICT supply chain), 5.22 (monitoring, review and change management of supplier services) and 5.23 (information security for use of cloud services). ISO 27002 itself points to the ISO 27036 series for further guidance on these controls: Parts 2 and 3 mainly elaborate 5.19 to 5.22, while Part 4 aligns with 5.23.
| Standard | Focus | Intended for | Role in OT |
|---|---|---|---|
| ISO 27001 / ISO 27002 | Management system and controls | Any organisation | Framework in which supplier management is audited |
| ISO 27036 | Security of the supplier relationship and supply chain | Acquirers and suppliers | Process for selection, contract, oversight and exit |
| IEC 62443-2-4 | Security programme of service providers | Integrators and maintenance contractors | Concrete requirements for those who build and maintain your plant |
| IEC 62443-4-1 | Secure product development | Component manufacturers | Requirements for how PLCs, DCSs and software are developed |
ISO 27036 is therefore generic and process-oriented, whereas IEC 62443 is specific to industrial automation. In an OT environment you use ISO 27036 to set up the supplier process and refer to IEC 62443-2-4 and 4-1 in your requirements.
🔐 Why does ISO 27036 matter for OT and ICS?
Supply chain risks weigh more heavily in ICS environments than in office IT. Suppliers carry out remote maintenance, deliver firmware and engineering software, and plants often run for twenty years or more with the same partner. Well-known incidents show what can go wrong: in NotPetya in 2017, malware spread through an update of accounting software, and in 2023 the 3CX desktop app was tampered with via a previously compromised software package.
| Risk | Without an ISO 27036 approach | With an ISO 27036 approach |
|---|---|---|
| Insecure firmware or software | No insight into components or the update process | SBOM, signed updates and vulnerability notifications set down in the contract |
| Unreliable suppliers | No due diligence at onboarding | Upfront assessment of security maturity |
| Tampered updates | No detection or response | Update verification and agreements on incident reporting |
| Uncontrolled external access | Permanent VPN accounts | Remote Access via a Jump Server and PAM, with logging |
| Weak contract | No basis for audits or requirements | Audit rights, notification deadlines and exit arrangements |
🏭 How do you apply ISO 27036 in an OT environment?
A practical approach for a manufacturer or utility:
- Map your suppliers - link each supplier to the systems and zones in your asset inventory that it can access or supplies software for.
- Classify by risk - distinguish, for example, critical suppliers (DCS, safety systems, remote maintenance) from suppliers without network access. Base this on your risk assessment.
- Set requirements per class - ask critical suppliers for an SBOM per release, a vulnerability disclosure process, signed firmware and a security programme in line with IEC 62443-2-4.
- Put it in the contract - include notification deadlines, audit rights, access rules and exit arrangements. Also require subcontractors to meet the same requirements.
- Control access technically - give external parties only temporary, personal access with MFA, through access control and session recording.
- Monitor and review - assess critical suppliers annually, for instance through questionnaires, certificates or an audit, and include suppliers in incident exercises.
- Exit cleanly - revoke accounts and certificates, change shared passwords and verify that no remote access remains.
This ties in with Third Party Risk Management and Supplier Security, which work out the same lifecycle in more detail.
🧱 Which legislation makes supplier security mandatory?
ISO 27036 itself is voluntary, but the topics it covers have become legal obligations in the EU:
- NIS2 - Article 21 lists supply chain security, including relationships with direct suppliers, as a mandatory measure. Organisations must take into account the vulnerabilities and development practices of their suppliers.
- Dutch Cybersecurity Act - the Dutch implementation of NIS2 (Cyberbeveiligingswet) entered into force on 15 August 2026, so its duty of care also covers supply chain security.
- Cyber Resilience Act - manufacturers of products with digital elements must report actively exploited vulnerabilities from 11 September 2026, and the full requirements apply from 11 December 2027. This strengthens your position as an acquirer.
- High-risk suppliers - for vital processes, the country a supplier comes from also matters, alongside quality.
ISO 27036 offers a recognised framework to demonstrate that you meet these obligations systematically.
❓ Frequently asked questions
Can an organisation be certified against ISO 27036?
There is no widely used accredited certification scheme for ISO 27036, even though Part 2 is titled Requirements. Organisations usually have supplier management assessed within an ISO 27001 certification, with ISO 27036 serving as guidance for the supplier controls. A supplier can still demonstrate that it follows the requirements of ISO 27036-2.
Which part of ISO 27036 is most relevant for OT?
For OT, ISO 27036-2 and ISO 27036-3 matter most. Part 2 describes the process from supplier selection to termination, and Part 3 covers risks in the hardware, software and services supply chain, such as tampered components. Part 4 deals with cloud services and is mainly relevant when you move OT data or management to the cloud.
What is the difference between ISO 27036 and IEC 62443-2-4?
ISO 27036 is a generic series for information security in all kinds of supplier relationships. IEC 62443-2-4 sets specific requirements for the security programme of service providers that build and maintain industrial automation systems. In OT, you use ISO 27036 for the process and IEC 62443-2-4 for the substantive requirements on integrators.
Is ISO 27036 mandatory under NIS2?
ISO 27036 is not mandatory under NIS2 or the Dutch Cybersecurity Act, because these laws do not prescribe a specific standard. NIS2 does, however, require supply chain security measures. ISO 27036 is a common way to meet that obligation in a demonstrable manner.
How old is ISO 27036?
ISO 27036 was published in four parts between 2013 and 2016. Part 1 was revised in 2021, Part 2 in 2022 and Part 3 in 2023, under the new series title Cybersecurity - Supplier relationships. Part 4 on cloud services is still the 2016 edition.
Does ISO 27036 require an SBOM?
ISO 27036 does not prescribe a specific format, but it does call for insight into the origin and composition of delivered hardware and software. An SBOM in SPDX or CycloneDX format is the practical way to achieve this. You should therefore include an SBOM requirement in your supplier contracts.
📌 In summary
ISO/IEC 27036 is the international series of standards for information security in supplier relationships: Part 2 sets requirements from planning to termination, Part 3 covers supply chain security for hardware, software and services, and Part 4 covers the security of cloud services. In OT, you combine ISO 27036 with IEC 62443-2-4 and 4-1 to control suppliers, remote maintenance and firmware updates, and so meet the supply chain obligations of NIS2, the Dutch Cybersecurity Act and the Cyber Resilience Act in a demonstrable way.