[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F27036":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",141,"International Organization for Standardization (ISO) and IEC","**What it covers.** A multi-part international standard on managing information security risks in supplier relationships. Its parts cover an overview and concepts, requirements for defining and managing supplier relationships, guidance for hardware, software and services supply chains, and guidance for securing cloud services.\n\n**In practice.** Applying it well means building information security into the full supplier life cycle: planning, selection, contracting, ongoing management and termination. Both acquirer and supplier responsibilities are defined, and security requirements flow into agreements and to sub-suppliers where relevant. Evidence includes a supplier management process, risk-based due diligence, contract clauses, monitoring records and exit plans.\n\n**Common gaps.** Typical gaps are focusing only on contract signature, no exit or transition planning, and little visibility into the supplier's own suppliers.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":23,"title":24,"published_at":25},"malicious-ad-networks-weaponized-to-silently-deploy-candiru-spyware","Malicious Ad Networks Weaponized to Silently Deploy Candiru Spyware","2026-10-15T22:20:22.695+00:00",{"slug":27,"title":28,"published_at":29},"hardware-implants-in-crypto-wallets-expose-supply-chain-risks","Hardware Implants in Crypto Wallets Expose Supply-Chain Risks","2026-10-14T18:20:46.881+00:00",{"slug":31,"title":32,"published_at":33},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":35,"title":36,"published_at":37},"preinstalled-malware-on-budget-android-phones-turns-devices-into-proxy-bots","Preinstalled Malware on Budget Android Phones Turns Devices Into Proxy Bots","2026-10-13T08:20:19.126+00:00",{"slug":39,"title":40,"published_at":41},"hardware-implants-in-crypto-wallets-highlight-critical-supply-chain-risk","Hardware Implants in Crypto Wallets Highlight Critical Supply Chain Risk","2026-10-12T18:20:21.423+00:00",{"slug":43,"title":44,"published_at":45},"contractor-malware-breach-exposes-87m-karaoke-customer-records","Contractor Malware Breach Exposes 8.7M Karaoke Customer Records","2026-10-11T16:20:18.527+00:00",{"slug":47,"title":48,"published_at":49},"cybersecurity-exec-arrested-for-alleged-extortion-tied-to-shinyhunters","Cybersecurity Exec Arrested for Alleged Extortion Tied to ShinyHunters","2026-10-10T16:20:18.738+00:00",{"slug":51,"title":52,"published_at":53},"ransomware-negotiation-firm-co-founder-arrested-in-shinyhunters-fbi-portal-breach","Ransomware Negotiation Firm Co-Founder Arrested in ShinyHunters FBI Portal Breach","2026-10-10T12:20:18.486+00:00",{"slug":55,"title":56,"published_at":57},"firmware-level-malware-pre-installed-on-budget-android-devices-worldwide","Firmware-Level Malware Pre-Installed on Budget Android Devices Worldwide","2026-10-09T10:20:27.189+00:00",{"slug":59,"title":60,"published_at":61},"firmware-level-malware-preinstalled-on-budget-android-devices","Firmware-Level Malware Preinstalled on Budget Android Devices","2026-10-08T16:20:21.318+00:00",{"slug":63,"title":64,"published_at":65},"asos-breach-highlights-third-party-platform-risk-and-cloud-data-exposure","ASOS Breach Highlights Third-Party Platform Risk and Cloud Data Exposure","2026-10-07T10:20:21.584+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",55,{"slug":73,"name":74,"problem":75,"stories":76},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",41,{"slug":78,"name":79,"problem":80,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",30,{"slug":83,"name":84,"problem":85,"stories":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",26,{"slug":88,"name":89,"problem":90,"stories":91},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",17,{"slug":93,"name":94,"problem":95,"stories":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",13,[98,104,110,115,121,126,131,137],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",136,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","15","Control 15","Service Provider Management",78,{"family":105,"item":111,"code":112,"title":113,"together":114},"2","Control 2","Inventory and Control of Software Assets",68,{"family":116,"item":117,"code":118,"title":119,"together":120},"gdpr","28","Article 28","Processor",48,{"family":99,"item":122,"code":123,"title":124,"together":125},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",40,{"family":116,"item":127,"code":128,"title":129,"together":130},"32","Article 32","Security of processing",35,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",34,{"family":105,"item":138,"code":139,"title":140,"together":141},"16","Control 16","Application Software Security",33]