Supplier Security Agreement Template (ISO/IEC 27036, A.5.20)
Security schedule for supplier contracts: clauses by tier, audit rights, incident notice, sub-contractors, data location, ICT supply chain, exit, deviations
SMKI & ISO/IEC 27001LengkapISO/IEC 27001:2022 A.5.19 to A.5.22 (cited only); ISO/IEC 27036-2:2022; ISO/IEC 27036-3:2023suppliersecurityagreement27036
Cara menggunakan: Use it when a supplier will access, process or store your information, connect to your systems or deliver software and hardware you depend on. Fill the supplier tier and clause selection first, then record every refused clause as a deviation. The main pitfall is signing security terms that nobody tracks afterwards, so turn each deliverable into a monitored obligation.
Pratinjau
Supplier Security Agreement: [Organization name] and [Supplier name]
A security schedule to attach to a supplier contract (master services agreement, purchase terms or statement of work). It sets the information security obligations of the supplier: security requirements, assurance and audit rights, incident notification, sub-contractors, data location, ICT supply chain duties, continuity, change and exit. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.5.19 to A.5.22, using the guidance of ISO/IEC 27036-2:2022 (requirements for supplier relationships) and ISO/IEC 27036-3:2023 (hardware, software and services supply chain security). Replace every
[bracketed]value and every row marked Example. This is a documentation format, not legal advice: have qualified counsel adapt it to the governing law and the main contract.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-068 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@legal-counsel], [@head-of-procurement], [@dpo], [@ciso] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential once completed for a supplier] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (A.5.19 to A.5.22, A.5.14, A.5.34, A.8.30); ISO/IEC 27036-1:2021, 27036-2:2022, 27036-3:2023; ISO/IEC 27002:2022 |
| Next scheduled review | YYYY-MM-DD (master: every 12 months and after a change in law or a supplier incident; instance: at each contract renewal) |
| Supplier | [Legal name, registration number, country] |
| Main contract reference | [Contract name and number, date] |
| Supplier tier | [Critical / High / Medium / Low] (from DOC-ISMS-066) |
| Supplier assessment | [Assessment reference and date] (DOC-ISMS-067) |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Clause library owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Legal counsel | [@legal-counsel] | [Approved for use] | YYYY-MM-DD |
| Procurement | [@head-of-procurement] | [Reviewed] | YYYY-MM-DD |
| Privacy | [@dpo] | [Reviewed] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@author] | First draft of the clause library |
| 1.0 | YYYY-MM-DD | [@author] | Approved for use |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |
Contents
- 1. Purpose, scope and use
- 2. Supplier tier and clause selection
- 3. Definitions
- 4. Security schedule clauses
- 5. Mapping to ISO/IEC 27001 and ISO/IEC 27036
- 6. Regulatory examples
- 7. Negotiation playbook
- 8. Deviations and risk acceptance
- 9. Obligation tracking and supplier monitoring
- 10. Worked example
- 11. Size tiers
- 12. Records and evidence
- 13. References
- Standard and licence note
1. Purpose, scope and use
This schedule sets out the information security obligations that [Supplier name] ("the Supplier") accepts when providing [description of goods or services] ("the Services") to [Organization name] ("the Customer"). It forms part of [main contract reference]. If this schedule and the main contract conflict on a security matter, [this schedule prevails / the order of precedence in the main contract applies].
Use the schedule as follows.
| Relationship | Form to use |
|---|---|
| Supplier processes, stores or accesses Customer information classified Internal or above | This schedule, clauses selected by tier |
| Supplier processes personal data on the Customer's behalf | This schedule plus a data processing agreement (legal-lite/dpa) |
| Supplier develops software for the Customer | This schedule plus isms/outsourced-development-security (DOC-ISMS-077) |
| Supplier provides cloud services on standard terms that cannot be changed | Gap review against this schedule, recorded in section 8 |
| Supplier has no access to information or systems (for example office supplies) | Standard purchase terms; no schedule |
The schedule does not replace the supplier assessment (DOC-ISMS-067), which decides whether to engage the Supplier, nor the confidentiality agreement (DOC-ISMS-051), which may already be in place before contract.
2. Supplier tier and clause selection
The Supplier tier is assigned in the supplier register (DOC-ISMS-066) from the data, access and business criticality of the Services. The tier determines which clauses are required.
| Clause group | Critical | High | Medium | Low |
|---|---|---|---|---|
| 4.1 Security programme and certification | Req | Req | Req | Opt |
| 4.2 Security requirements | Req | Req | Req (short list) | Opt |
| 4.3 Personnel | Req | Req | Req | Opt |
| 4.4 Data location and handling | Req | Req | Req | Not used |
| 4.5 Sub-contractors | Req | Req | Req | Opt |
| 4.6 ICT supply chain | Req | Req | Opt | Not used |
| 4.7 Incident notification and cooperation | Req | Req | Req | Req (notice only) |
| 4.8 Assurance and audit rights | Req | Req | Opt (reports only) | Not used |
| 4.9 Continuity and resilience | Req | Opt | Opt | Not used |
| 4.10 Change management | Req | Req | Opt | Not used |
| 4.11 Return, deletion and exit | Req | Req | Req | Opt |
| 4.12 Non-compliance and remedies | Req | Req | Req | Opt |
Selected for this Supplier: tier [tier]; clauses [list]; omitted clauses and reason: [reason].
3. Definitions
| Term | Meaning in this schedule |
|---|---|
| Customer Information | Any information, in any form, that the Supplier receives from, creates for or accesses on behalf of the Customer, including personal data |
| Security Incident | An event that has compromised, or is reasonably believed to have compromised, the confidentiality, integrity or availability of Customer Information or of the Services |
| Sub-contractor | Any third party that the Supplier uses to perform part of the Services, including hosting and cloud providers, sometimes called a fourth party |
| Security Requirements | The requirements in clause group 4.2 and any Customer standard listed in Annex 1 of the signed schedule |
| Assurance Report | An independent report or certificate covering the Services, such as an ISO/IEC 27001 certificate with matching scope or an independent service auditor's report |
| Business Day | As defined in the main contract |
4. Security schedule clauses
4.1 Security programme and certification
- SAC-01 The Supplier shall maintain a documented information security programme, approved by its management, that covers the Services and is reviewed at least every [12] months.
- SAC-02 The Supplier shall maintain [an ISO/IEC 27001 certificate issued by a certification body accredited by an accreditation body that is a signatory of the Global ACI MRA (formerly the IAF MLA) / an independent assurance report] whose scope covers the Services, and shall tell the Customer within [30] days if it is suspended, withdrawn, reduced in scope or not renewed.
- SAC-03 The Supplier shall name a security contact who is authorised to discuss security matters and receive notices under this schedule, and shall keep the contact details current.
4.2 Security requirements
- SAC-04 The Supplier shall protect Customer Information with controls appropriate to its classification, and at least those listed in Annex 1 (Customer security requirements) of the signed schedule.
- SAC-05 Access to Customer Information and Customer systems shall be limited to Supplier personnel who need it for the Services, granted individually, protected by multi-factor authentication and removed within [1 Business Day] when no longer needed.
- SAC-06 Customer Information shall be encrypted in transit over public networks and at rest in Supplier systems using current industry practice, with keys managed so that Supplier staff cannot casually read the data.
- SAC-07 The Supplier shall keep security logs for systems that process Customer Information for at least [12] months and provide relevant extracts on request during an investigation.
- SAC-08 The Supplier shall remediate vulnerabilities in systems that process Customer Information within [Critical: 7 days, High: 30 days] of a fix becoming available, or apply an equivalent mitigation, and shall carry out an independent penetration test of the Services at least every [12] months.
- SAC-09 Where the Supplier connects to Customer networks or systems, it shall use only the methods approved by the Customer, from managed and protected devices, and comply with the Customer's acceptable use rules (DOC-ISMS-040).
- SAC-10 Software developed or configured for the Customer shall be produced under a secure development life cycle, with security testing before delivery (see DOC-ISMS-077 for development engagements).
4.3 Personnel
- SAC-11 Supplier personnel with access to Customer Information shall be screened in line with applicable law before access, be bound by written confidentiality obligations, and receive security awareness training at least every [12] months.
- SAC-12 The Supplier shall maintain a current list of personnel with privileged or administrative access to Customer systems or data and provide it on request.
4.4 Data location and handling
- SAC-13 Customer Information shall be stored and processed only in [list of countries or regions], and accessed remotely only from [list], unless the Customer agrees in writing in advance.
- SAC-14 The Supplier shall use Customer Information only to provide the Services. It shall not use Customer Information to train or improve general-purpose models, analytics products or services for other customers without the Customer's written consent.
- SAC-15 The Supplier shall tell the Customer promptly, unless legally prohibited, of any request by a public authority for access to Customer Information, and shall challenge requests it considers unlawful.
4.5 Sub-contractors
- SAC-16 The Supplier shall not use a Sub-contractor for any part of the Services that involves Customer Information without [prior written consent / at least 30 days' prior notice with a right to object].
- SAC-17 The Supplier shall flow down obligations at least as protective as this schedule to each Sub-contractor, assess each Sub-contractor's security before use and at least every [24] months, and remain responsible to the Customer for their performance.
- SAC-18 The Supplier shall maintain and provide on request a list of Sub-contractors with the service performed and the locations used.
4.6 ICT supply chain
- SAC-19 For software or devices delivered to the Customer, the Supplier shall provide a software bill of materials in a recognised machine-readable format (for example SPDX or CycloneDX) on delivery and with each major release.
- SAC-20 The Supplier shall maintain a vulnerability disclosure and handling process for its products, notify the Customer of exploitable vulnerabilities affecting delivered products within [5 Business Days] of confirmation, and provide security updates for at least [the support period stated in the order].
- SAC-21 The Supplier shall take reasonable steps to ensure the integrity and authenticity of delivered software and hardware, such as signed releases, protected build systems, and sourcing of components from authorised channels, and shall tell the Customer of any known counterfeit or tampered component.
- SAC-22 The Supplier shall identify components or services in its own supply chain that are critical to the Services and tell the Customer of any concentration on a single upstream provider that could interrupt them.
4.7 Incident notification and cooperation
- SAC-23 The Supplier shall notify the Customer's security contact of any Security Incident without undue delay and in any case within [24] hours of becoming aware of it, through [channel].
- SAC-24 The notification shall include, as far as known: what happened, when, Customer Information and Services affected, actions taken, and a contact. The Supplier shall provide updates at least every [24] hours until containment and a written root cause report within [10] Business Days after closure.
- SAC-25 The Supplier shall cooperate with the Customer's investigation, preserve relevant evidence, and support the Customer in meeting its own legal notification duties, including those for personal data breaches.
4.8 Assurance and audit rights
- SAC-26 The Supplier shall provide its current Assurance Reports, penetration test summary and a completed security questionnaire on request, at least once every [12] months.
- SAC-27 The Customer, or an independent auditor it appoints and who is bound by confidentiality, may audit the Supplier's compliance with this schedule once every [12] months on [30] days' notice, and at any time after a Security Incident or where a regulator requires it. Audits shall be conducted during business hours and shall not require access to other customers' data.
- SAC-28 The Supplier shall remedy findings from audits or assessments within the agreed plan and report progress to the Customer.
4.9 Continuity and resilience
- SAC-29 The Supplier shall maintain and test, at least every [12] months, business continuity and recovery arrangements for the Services that meet recovery objectives of [RTO] and [RPO], and share a summary of the latest test result on request.
- SAC-30 The Supplier shall participate, when reasonably requested, in the Customer's continuity or incident exercises that involve the Services.
4.10 Change management
- SAC-31 The Supplier shall give the Customer at least [30] days' notice of changes that could reduce the security of the Services, including changes to locations, Sub-contractors, security features, certifications or ownership of the Supplier.
- SAC-32 Emergency changes made to protect the Services may be made without prior notice, with notice to the Customer within [2] Business Days.
4.11 Return, deletion and exit
- SAC-33 During the term and for [90] days after termination, the Supplier shall return Customer Information on request in [format], complete and with integrity checks.
- SAC-34 After return, or on the Customer's instruction, the Supplier shall securely delete Customer Information from its systems and those of its Sub-contractors, except where law requires retention, and give written confirmation within [30] days. Backups shall be deleted in their normal rotation and protected until then.
- SAC-35 For Critical suppliers, the Supplier shall provide reasonable exit assistance, at [agreed rates], for up to [6] months to support transfer to the Customer or a replacement provider (see DOC-ISMS-076 for cloud services).
- SAC-36 The Supplier shall revoke all access to Customer systems and return or destroy Customer-owned equipment, credentials and tokens at termination.
4.12 Non-compliance and remedies
- SAC-37 The Supplier shall tell the Customer promptly if it cannot comply with any clause of this schedule, with a remediation plan.
- SAC-38 Material breach of this schedule, or repeated failure to remedy findings, is a material breach of the main contract, giving the Customer the remedies stated there, including [suspension of data transfers and termination].
- SAC-39 Obligations in clauses SAC-14, SAC-15, SAC-25, SAC-33 and SAC-34 survive termination for as long as the Supplier holds Customer Information.
5. Mapping to ISO/IEC 27001 and ISO/IEC 27036
| Clause group | ISO/IEC 27001:2022 Annex A | ISO/IEC 27036 topic (own words) |
|---|---|---|
| 4.1 Security programme | A.5.19 supplier relationships, A.5.20 supplier agreements | Part 2: supplier security commitments within the agreement |
| 4.2 Security requirements | A.5.20, A.5.15, A.8.5, A.8.8, A.8.15, A.8.24 | Part 2: security requirements agreed and documented |
| 4.3 Personnel | A.6.1 screening, A.6.6 confidentiality, A.6.3 training | Part 2: personnel of the supplier |
| 4.4 Data location and handling | A.5.14 information transfer, A.5.31, A.5.34 | Parts 2 and 4: information handling and location |
| 4.5 Sub-contractors | A.5.19, A.5.21 ICT supply chain | Parts 2 and 3: flow-down through the supply chain |
| 4.6 ICT supply chain | A.5.21, A.8.8, A.8.30 | Part 3: visibility, integrity and vulnerability handling in hardware, software and services supply chains |
| 4.7 Incident notification | A.5.24 to A.5.26, A.5.28 | Part 2: incident communication between acquirer and supplier |
| 4.8 Assurance and audit | A.5.22 monitoring and change, A.5.35 | Part 2: monitoring the supplier's conformity |
| 4.9 Continuity | A.5.29, A.5.30 | Part 2 (continuity itself is covered by ISO 22301 and, for ICT readiness, ISO/IEC 27031) |
| 4.10 Change management | A.5.22, A.8.32 | Part 2: managing changes to the relationship |
| 4.11 Exit | A.5.20, A.5.11 return of assets, A.8.10 deletion | Part 2: relationship termination |
| 4.12 Remedies | A.5.20 | Part 2: handling non-conformity in the relationship |
ISO/IEC 27036-1:2021 gives the overview and concepts, ISO/IEC 27036-2:2022 the requirements for defining, running and ending supplier relationships from both the acquirer and supplier side, ISO/IEC 27036-3:2023 the guidance for hardware, software and services supply chains, and ISO/IEC 27036-4:2016 the guidance for cloud services. ISO/IEC 27036 is not a certification standard; use it to design the process and the terms.
6. Regulatory examples
| Regime (example) | What it expects in supplier terms (summary) | Clauses that help |
|---|---|---|
| GDPR (Regulation (EU) 2016/679), Article 28 | A written processor contract with set content, including instructions, confidentiality, security, sub-processor authorisation, assistance and deletion or return | SAC-11, SAC-16 to SAC-18, SAC-25, SAC-33, SAC-34, plus the DPA |
| NIS2 (Directive (EU) 2022/2555), Article 21(2)(d) | Supply chain security, including security aspects of relationships with direct suppliers, within the entity's risk management measures | Groups 4.1, 4.2, 4.5, 4.6, 4.8 (see compliance/nis2-security-measures) |
| DORA (Regulation (EU) 2022/2554), Article 30 | Key contractual provisions for ICT third-party services to financial entities, with extra provisions for services supporting critical or important functions (such as exit strategies, testing participation and full monitoring rights) | Groups 4.4, 4.7 to 4.11 (see compliance/dora-ict-third-party-register) |
| EU Cyber Resilience Act (Regulation (EU) 2024/2847) | Security obligations on manufacturers of products with digital elements, including vulnerability handling and an SBOM, applying in stages | SAC-19 to SAC-21 |
| US sector rules (examples: health, financial services) | Business associate or service provider terms with security and breach notification content | Groups 4.2, 4.7, 4.11 |
7. Negotiation playbook
| Clause | Preferred position | Acceptable fallback | Below fallback (needs risk acceptance) |
|---|---|---|---|
| SAC-02 certification | ISO/IEC 27001 certificate covering the Services | Independent assurance report covering the Services, or certificate with a 12-month plan to extend scope | Questionnaire only, no independent assurance |
| SAC-13 data location | Named countries, change only with consent | Named regions, change with 30 days' notice and right to terminate | No commitment on location |
| SAC-16 sub-contractors | Prior written consent | Notice with right to object and terminate | Published list only, no notice |
| SAC-23 incident notice | 24 hours from awareness | 48 hours from confirmation, plus early informal notice | "Without undue delay" with no outer limit, for Critical suppliers |
| SAC-27 audit rights | Direct audit every 12 months | Assurance reports plus audit after an incident or at regulator request | No audit right and no independent report |
| SAC-34 deletion | Confirmation within 30 days including sub-contractors | Confirmation within 90 days, backups aged out within a stated period | No confirmation |
| SAC-35 exit assistance | Up to 6 months at agreed rates | Up to 3 months at time and materials | None for a Critical supplier |
| SAC-38 remedies | Material breach with termination right | Service credits plus termination after repeated failure | No remedy |
8. Deviations and risk acceptance
| ID | Supplier and contract | Clause | Gap | Risk score (L x I) | Band | Compensating control | Decision | Approver | Review date |
|---|---|---|---|---|---|---|---|---|---|
| DEV-001 (Example) | Public cloud provider, enterprise agreement | SAC-27 | No customer audit right; assurance reports only | 2 x 3 = 6 | Medium | Annual review of the provider's independent reports and certificate scope | Accepted | Risk owner (Head of Engineering Operations) and department head (CTO) | YYYY-MM-DD |
| DEV-002 (Example) | Payroll SaaS, standard terms | SAC-23 | "Without undue delay", no outer limit | 2 x 4 = 8 | Medium | Payroll data minimised; supplier status page monitored | Accepted | Risk owner (Head of People) and department head (COO) | YYYY-MM-DD |
| DEV-003 (Example) | OT maintenance vendor, frame contract | SAC-19 | No SBOM for legacy controllers | 3 x 4 = 12 | High | Network isolation of controllers, vendor remote access only through monitored jump host | Accepted with treatment plan | Top management | YYYY-MM-DD |
Bands follow DOC-ISMS-010: Low 1 to 4, Medium 5 to 9, High 10 to 16, Critical 17 to 25 (in practice 20 and 25). Medium deviations are accepted by the risk owner and the department head. High deviations need top management acceptance with a treatment decision; Critical deviations are not accepted without treatment except by documented top management decision. Record accepted deviations in the risk acceptance record (DOC-ISMS-019).
9. Obligation tracking and supplier monitoring
| ID | Clause | Deliverable | Frequency | Owner | Last received | Next due | Status |
|---|---|---|---|---|---|---|---|
| OBL-001 (Example) | SAC-02 | Certificate and scope statement | Annually and on change | Vendor manager | YYYY-MM-DD | YYYY-MM-DD | Current |
| OBL-002 (Example) | SAC-08 | Penetration test summary | Annually | Security lead | YYYY-MM-DD | YYYY-MM-DD | Overdue |
| OBL-003 (Example) | SAC-18 | Sub-contractor list | On change, checked every 6 months | DPO | YYYY-MM-DD | YYYY-MM-DD | Current |
| OBL-004 (Example) | SAC-29 | Continuity test summary | Annually | Business continuity lead | YYYY-MM-DD | YYYY-MM-DD | Current |
| OBL-005 (Example) | SAC-26 | Completed security questionnaire | Annually | Vendor manager | YYYY-MM-DD | YYYY-MM-DD | Requested |
Monitoring frequency follows the tier in the supplier register: Critical and High every 12 months, Medium every 24 months, Low at renewal and at most every 36 months (Example, align with DOC-ISMS-067).
10. Worked example
Quillmere Health Systems (medium tier, 320 staff) contracts a managed detection and response provider to monitor its two offices, its colocation suite and its public cloud tenant around the clock.
| Item | Value (Example) |
|---|---|
| Supplier tier | Critical: privileged access to security tooling and logs containing patient scheduling data |
| Assessment | Supplier assessment completed, ISO/IEC 27001 certificate covering the managed service, independent assurance report for a 12-month period |
| Clauses selected | All groups 4.1 to 4.12 |
| Negotiated values | SAC-05 access removal within 4 hours; SAC-13 data stored in two named regions; SAC-23 notice within 12 hours because the provider holds security telemetry; SAC-27 one audit every 12 months plus after incidents; SAC-35 exit assistance for 6 months |
| Deviations | SAC-19 not applicable (no software delivered); SAC-16 accepted as 30 days' notice with right to object and terminate (within fallback, no deviation) |
| Personal data | Processor terms added through the DPA, with hospital customer flow-down requirements |
| Obligations tracked | 9 obligations in the tracker, first review 6 months after go-live |
| Approval | ISMS manager, legal counsel and COO, YYYY-MM-DD |
11. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites in 4 countries) |
|---|---|---|---|
| Typical suppliers (Example) | One public cloud provider, collaboration suite, about 25 SaaS tools, a contractor agency, a penetration testing firm | Cloud and colocation providers, managed detection and response, about 80 SaaS tools, clinical integration partners | Hundreds of suppliers including OT equipment vendors, logistics, outsourced IT services and regional cloud tenants |
| Use of the schedule | Mostly gap reviews of standard terms with deviation records; full schedule where the supplier accepts it (contractor agency, penetration testing firm, identity provider, device management, CRM) | Full schedule for Critical and High suppliers; short form for Medium | Clause library in the procurement system, selected automatically by tier; regional legal variants per country |
| Negotiation | ISMS manager (0.5 FTE) and external counsel when needed | Legal counsel with the security team | Procurement category managers, legal, third-party risk team |
| Monitoring | Review every 12 months for Critical and High suppliers in a spreadsheet tracker | Obligation tracker in the GRC tool, quarterly review for Critical | Third-party risk platform, continuous monitoring for Critical suppliers, steering committee reporting |
| Supply chain clauses | Rarely used beyond the SaaS terms | Used for clinical software partners | Required for OT vendors, with SBOM and remote access terms |
12. Records and evidence
| Record | Proves | Owner | Location | Retention (Example) |
|---|---|---|---|---|
| Approved master clause library (this document) | A standard exists and is controlled | ISMS manager | [Document repository] | Current plus superseded versions for 6 years |
| Signed schedules per supplier | Requirements are agreed in contracts | Legal counsel | [Contract repository] | Life of contract plus 6 years |
| Clause selection and tier rationale | Terms match the tier | Vendor manager | [Supplier file] | Life of contract plus 3 years |
| Deviation records and risk acceptances | Gaps are known and decided | ISMS manager | DOC-ISMS-019, risk register DOC-ISMS-016 | Life of contract plus 3 years |
| Obligation tracker and received deliverables | Suppliers are monitored | Vendor manager | [GRC tool or tracker] | 3 years |
| Incident notifications from suppliers | Notification clauses operate | Security lead | Incident register DOC-ISMS-021 | 6 years |
| Deletion confirmations at exit | Exit clauses operate | Technical owner | [Supplier file] | 6 years after exit |
Map each record to controls A.5.19 to A.5.22 in isms/control-evidence-matrix.
13. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024, https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html | Current | A.5.19 to A.5.22 and related controls |
| ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html | Current | Control guidance |
| ISO/IEC 27036-1:2021, https://www.iso.org/standard/82905.html | Current | Overview and concepts of supplier relationship security |
| ISO/IEC 27036-2:2022, https://www.iso.org/standard/82060.html | Current | Requirements for supplier relationships |
| ISO/IEC 27036-3:2023, https://www.iso.org/standard/82890.html | Current | Hardware, software and services supply chain security |
| ISO/IEC 27036-4:2016, https://www.iso.org/standard/59689.html | Current | Security of cloud services |
| GDPR, Regulation (EU) 2016/679 | As amended; check the consolidated text | Processor contracts, Article 28 |
| NIS2, Directive (EU) 2022/2555 | As published; check national transposition | Supply chain security, Article 21(2)(d) |
| DORA, Regulation (EU) 2022/2554 | Applies from 2025-01-17 | Contractual provisions, Article 30 |
| EU Cyber Resilience Act, Regulation (EU) 2024/2847 | Obligations apply in stages | Product security and vulnerability handling |
| Related templates | compliance/supplier-security-assessment, isms/supplier-register, isms/cloud-services-security-policy, isms/outsourced-development-security, security/supply-chain-security, security/sbom-vex-policy, legal-lite/dpa, isms/confidentiality-nda, isms/cloud-exit-plan, isms/customer-security-addendum, compliance/dora-ict-third-party-register, compliance/nis2-security-measures, isms/control-evidence-matrix |
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (Annex A controls A.5.19 to A.5.22), ISO/IEC 27002:2022 and ISO/IEC 27036-1:2021, 27036-2:2022, 27036-3:2023 and 27036-4:2016. The model clauses, tables, playbook and examples are original text, and no text from ISO/IEC standards is reproduced; topics of ISO/IEC 27036 are described in own words. EU legal acts are summarised, not quoted. This is a documentation format, not legal advice. Obtain the official standards from ISO, IEC or your national standards body, and check the current edition of each standard and the current official text of each law before use.
Template licence: MIT.
Templat terkait
SMKI & ISO/IEC 27001
Cloud Services Security Policy Template (ISO/IEC 27001 A.5.23)
Cloud policy for A.5.23: shared responsibility, tiers, due diligence, contract terms, configuration, monitoring, exit, shadow IT, cloud register
SMKI & ISO/IEC 27001Customer Security Addendum Template (ISO/IEC 27001 A.5.20)
Order of precedence, certifications upkeep, personnel, sub-processors, data location, incident notification, audit rights, testing, deletion, liability pointer, negotiation playbook
SMKI & ISO/IEC 27001Employee Security Handbook Template (ISO/IEC 27001 A.6.3)
Plain-language staff handbook: 14 security rules (passwords, MFA, phishing, devices, data, travel, AI tools, reporting), contacts, acknowledgement form