本文件规定了定义、实施、操作、监控、审查、维护和改善供应商和收单机构关系的基本信息安全要求。 这些要求涵盖产品和服务的任何采购和供应，例如制造或组装、业务流程采购、软件和硬件组件、知识流程采购、构建-运营-转让和云计算服务。 本文件适用于所有组织，无论其类型、规模和性质如何。 为了满足这些要求，预计一个组织已经在内部实施了许多基本过程，或者正在积极计划这样做。这些过程包括但不限于:业务管理、风险管理、运营和人力资源管理以及信息安全。

This document specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships. These requirements cover any procurement and supply of products and services, such as manufacturing or assembly, business process procurement, software and hardware components, knowledge process procurement, build-operate-transfer and cloud computing services. This document is applicable to all organizations, regardless of type, size and nature. To meet the requirements, it is expected that an organization has internally implemented a number of foundational processes or is actively planning to do so. These processes include, but are not limited to: business management, risk management, operational and human resources management, and information security.