ASD Essentials IT.GOV-11.1 Base Supplier Selection on Proportionate Cyber Supply Chain Risk Assessments
What it says
Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks each supplier's cyber security risk before taking them on, looks harder at riskier suppliers, and keeps evidence supporting the decision.
Before choosing a supplier of software, hardware or services, the organisation checks the cyber risk it brings. This is a supply chain risk assessment. Critical suppliers, or those reaching key systems and data, get deeper checks. To meet this, every in-scope supplier is checked against approved criteria before signing. Findings shape the decision and the contract, and the evidence is kept. For example, a cloud payroll firm gets a deeper check than a keyboard supplier.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
A supplier taken on without a check that fits its risk can bring in unsafe products, such as hacked software updates or tampered hardware. Unrecorded findings leave known concerns unmanaged, and nobody can show why the supplier was trusted.
How to implement
The head of security should write a supplier security check procedure and have the executive or risk committee approve it.
Set which suppliers are in scope, who is involved and what records are kept.
The security team and procurement should group suppliers into tiers by how critical their product or service is and what systems and data they reach.
Set approved criteria for each tier, with deeper checks for higher tiers.
Procurement should make the tiered check a required step in buying and contract approval, such as a field on the purchase request form.
No supplier is signed up until its check is complete.
The business owner and security lead should approve, approve with conditions, or decline each supplier based on the findings.
Legal writes the required security measures into the contract, and any leftover risk goes in the risk register.
The person who did the check should file the check and decision with evidence suited to the tier, such as questionnaire answers, certifications or independent reports.
Keep it all in one central supplier record under the organisation's record-keeping rules.
Keep it running
Run the check as a required step before choosing and taking on any in-scope supplier, urgent purchases included. Keep the assessment, decision, contract clauses, risk register entry and evidence together in one supplier record. This action applies organisation-wide, in every priority phase, so set up the process, criteria and roles early. Procurement, business owners, legal and security each have a part.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the supplier security check process and its approval record.
Look at
Whether it is approved and sets scope, roles and criteria, or is only informal practice.
Good evidence
An approved process covers software, hardware and service suppliers and is applied consistently.
- Check 2 of 5What an auditor asks for
Ask for
Ask for suppliers engaged this period, with check and start dates, and purchasing records.
Look at
Whether any supplier was taken on unchecked, or checked only after signing or go-live.
Good evidence
Every in-scope supplier was checked before it was selected and taken on.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the approved criteria and tiers, then sample checks from each tier.
Look at
Whether criteria are written and applied alike, and checks get deeper as the supplier's importance rises.
Good evidence
Approved criteria match the depth of each check to the supplier's risk, applied consistently.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the decision, signed contract and risk entry where a check raised concerns.
Look at
Whether findings shaped the decision and reached the contract, or stayed in the report.
Good evidence
Findings shaped each decision and the contract, and leftover risk is in the risk register.
- Check 5 of 5What an auditor asks for
Ask for
Ask for decision records and kept evidence for sampled suppliers across tiers.
Look at
Whether outcomes are written down, and the evidence suits the tier and can be produced.
Good evidence
Each decision is recorded, with evidence on file that suits the supplier's risk.
ASD indicators of good practice (11)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(4)
- NE-1No documented or approved governance process exists for evaluating the cyber security trustworthiness of suppliers.
- NE-2No cyber security evaluation is performed before suppliers are onboarded.
- NE-3Evaluation outcomes are not documented.
- NE-4Findings from supplier evaluation outcomes are not used to inform supplier approval, contractual requirements or risk treatment decisions where concerns are identified.
Partially effective(3)
- PE-1An evaluation process exists but is not consistently applied to all suppliers within scope.
- PE-2Evaluation is performed for some suppliers, but criteria are not documented or are inconsistently applied.
- PE-3Outcomes are documented but contractual arrangements do not reflect identified risks or required controls.
Fully effective(4)
- FE-1A documented and approved governance process is in place and consistently applied.
- FE-2Cyber security trustworthiness evaluations are performed for all suppliers within scope prior to onboarding.
- FE-3Evaluation criteria are documented, approved and proportionate to the criticality of what the supplier delivers.
- FE-4Evaluation outcomes are documented, reflected in contractual arrangements and recorded in the organisation’s risk register where residual risk remains.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing Information Security in Supplier Relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
IT.GOV-11.1 requires suppliers of software, hardware and services to be selected and engaged on the basis of a proportionate cyber supply chain risk assessment, with assurance evidence retained to support the decision. Risk-based supplier selection is a specific part of the processes ISO/IEC 27001 Annex A 5.19 requires to manage information security risks from the use of suppliers' products or services. Annex A 5.19 covers the whole supplier relationship, whereas IT.GOV-11.1 addresses the selection and engagement stage.
This control partially meets A.5.21.
IT.GOV-11.1 requires suppliers of software, hardware and services to be selected and engaged on the basis of a cyber supply chain risk assessment proportionate to the risk they introduce, with assurance evidence retained to support the decision. This is a specific implementation of ISO/IEC 27001 Annex A 5.21, which requires processes and procedures to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 spans the whole supply chain risk process, while IT.GOV-11.1 focuses on the risk-based selection and engagement decision.
This control partially overlaps A.5.20.
IT.GOV-11.1 requires suppliers to be selected and engaged on the basis of a cyber supply chain risk assessment proportionate to the risk each supplier introduces. That assessment provides the basis for ISO/IEC 27001 Annex A 5.20, which requires relevant information security requirements to be established and agreed with each supplier according to the type of supplier relationship. IT.GOV-11.1 covers the risk-based selection decision and retention of assurance evidence, while Annex A 5.20 covers agreeing the resulting security requirements with the supplier.
This control partially overlaps A.5.23.
IT.GOV-11.1 requires suppliers of software, hardware and services to be selected and engaged on the basis of a proportionate cyber supply chain risk assessment, with assurance evidence retained. For cloud service providers this directly forms part of the acquisition process that ISO/IEC 27001 Annex A 5.23 requires to be established in line with the organisation's information security requirements. IT.GOV-11.1 applies to all supplier types but only at selection, while Annex A 5.23 is limited to cloud services and also covers their use, management and exit.
ASD Information Security Manual: 5 mappings
This control partially overlaps ISM-1452.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1452 requires that assessment itself for suppliers of operating systems, applications, IT and OT equipment and services, gauging impact on system risk.
This control partially overlaps ISM-1568.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1568 sets one selection criterion, procuring from suppliers that have demonstrated a commitment to the security of their products and services.
This control partially overlaps ISM-1631.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1631 is a prerequisite step, identifying the suppliers of operating systems, applications, IT and OT equipment and services associated with systems.
This control partially overlaps ISM-1632.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1632 sets a specific selection criterion, procuring from suppliers with a strong track record of maintaining the security of their own systems.
This control partially overlaps ISM-1787.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1787 puts that selection into effect, requiring operating systems, applications, IT and OT equipment and services to be sourced from approved suppliers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.