ASD Essentials IT.GOV-11.2 Maintain Current Supplier Assurance and Act on Lapses or Risk Changes
What it says
Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeeps up-to-date proof that suppliers still meet their security promises, and acts when that proof lapses or a supplier's risk changes.
After signing, the organisation keeps checking that each supplier still keeps its security promises. It collects up-to-date proof, demanding more from the suppliers it relies on most. To meet this, an approved process sets what proof counts and how recent it must be. Each item is read for problems. When proof lapses or a supplier's risk changes, the organisation acts within set timeframes. For example, it chases a supplier whose security certification has expired.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without current proof, a supplier's security can quietly decline, through expired certifications, open audit findings or an unreported breach. Its products stay trusted anyway, giving attackers a way in through the supplier. Lapses not acted on leave known weaknesses open.
How to implement
The head of security should get a supplier evidence procedure approved, with fix timeframes.
For each tier, it sets accepted evidence, scope and how recent it must be, and what counts as a lapse or risk change.
Procurement and contract owners should keep one supplier register, such as a shared spreadsheet, rating each supplier's importance and risk.
Record the evidence its tier needs, the evidence held and when it expires.
The owner of supplier checks should request new evidence, such as an updated audit report, before the old one expires.
Treat missing, expired or out-of-scope evidence as a lapse, and have security staff read each item for relevant findings.
Security staff and contract owners should watch for supplier risk changes, such as a breach, hacked updates, new owners or hosting, or new access.
Any of these should start an early reassessment.
Contract owners, with security and legal, should resolve each lapse or serious concern by a contract fix, extra safeguards or a new supplier.
Track each one to closure within the set timeframes, and escalate any that are overdue.
Keep it running
Run supplier checks as a standing routine. Keep the supplier register current, chase renewals before evidence expires, and report overdue evidence and open concerns to the group that owns supplier risk. Contract owners should reassess early when a supplier has an incident, changes owner, hosting or subcontractors, or takes on more services or wider access. This action applies organisation-wide, in every priority phase, to every supplier that delivers or supports the organisation's systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the supplier evidence procedure and its approval record.
Look at
Whether it is approved and sets accepted evidence, scope and age limits, or is vague or unevenly applied.
Good evidence
An approved procedure sets evidence types, scope and how recent it must be for each tier.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the supplier register with each supplier's risk rating, evidence held and expiry dates.
Look at
Whether suppliers lack evidence or hold expired evidence, and critical ones face no stricter demands.
Good evidence
Every in-scope supplier has current evidence, with stricter demands on the most critical.
- Check 3 of 5What an auditor asks for
Ask for
Ask for a sample of recent supplier evidence and the review notes made on each item.
Look at
Whether items were read for reported problems and gaps in coverage, or simply filed unread.
Good evidence
Each item has a recorded review noting relevant findings and the action taken.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the log of supplier lapses and concerns, with actions taken and closure dates.
Look at
Whether concerns were handled informally or unevenly, or stayed open past the set timeframes.
Good evidence
Serious concerns close on time through a contract fix, extra safeguards or a new supplier.
- Check 5 of 5What an auditor asks for
Ask for
Ask the team to walk through recent cases where a supplier's proof lapsed or risk changed.
Look at
Whether the process caught the change and started a reassessment, or it was found late or ignored.
Good evidence
The process catches lapses and risk changes, and each leads to a recorded decision.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No process exists to obtain and risk-assess current supplier assurance evidence proportionate to supplier criticality and risk.
- NE-2No documented and approved governance process exists for maintaining assurance that suppliers meet their cyber security commitments.
- NE-3No actions are taken when supplier cyber security assurance lapses or supplier risk changes.
Partially effective(3)
- PE-1Supplier assurance evidence is obtained for some suppliers, but coverage is incomplete or the evidence is not reviewed and actioned.
- PE-2Some findings are actioned but the response process is informal or inconsistent.
- PE-3A process exists but acceptable forms and currency of assurance evidence are not defined or applied consistently.
Fully effective(3)
- FE-1Current assurance evidence is obtained from suppliers in proportion to their criticality and risk, and is reviewed for findings that affect the organisation.
- FE-2Material concerns are addressed through contractual remediation, compensating controls or supplier substitution within defined timeframes.
- FE-3A documented and approved governance process specifies the acceptable forms, scope and currency of supplier assurance evidence.
Mappings
Closest match in ISO/IEC 27001: A.5.22, Monitoring and Managing Supplier Services, which asks for the same thing.
ISO/IEC 27001: 6 mappings
This control is equivalent to A.5.22.
IT.GOV-11.2 requires the organisation to maintain current assurance that suppliers continue to meet their cyber security commitments, and to act when that assurance lapses or a supplier's risk changes. ISO/IEC 27001 Annex A 5.22 requires the same ongoing monitoring, review and evaluation of supplier information security practices, together with management of changes in them. The two are substantially equivalent, although Annex A 5.22 also refers explicitly to monitoring supplier service delivery.
This control partially meets A.5.19.
IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when that assurance lapses or the supplier's risk changes. This is a specific part of the supplier risk management processes that ISO/IEC 27001 Annex A 5.19 requires for the use of suppliers' products or services. Annex A 5.19 covers the full supplier relationship, while IT.GOV-11.2 addresses only the ongoing assurance stage.
This control partially meets A.5.21.
IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when that assurance lapses or the supplier's risk changes. This is a specific component of ISO/IEC 27001 Annex A 5.21, which requires processes and procedures to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 covers the broader supply chain risk process, whereas IT.GOV-11.2 focuses on continuing supplier assurance and response.
This control partially overlaps A.5.23.
IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when assurance lapses or supplier risk changes. For cloud service providers this forms part of the use and management processes that ISO/IEC 27001 Annex A 5.23 requires to align with the organisation's information security requirements. IT.GOV-11.2 applies to all suppliers but only to ongoing assurance, while Annex A 5.23 is limited to cloud services and also covers acquisition and exit.
This control partially overlaps A.8.30.
IT.GOV-11.2 requires ongoing assurance that suppliers continue to meet their cyber security commitments, with action taken when assurance lapses or supplier risk changes. Where the supplier performs system development, that assurance forms part of the monitoring and review of outsourced development activities required by ISO/IEC 27001 Annex A 8.30. IT.GOV-11.2 covers all suppliers, while Annex A 8.30 is limited to outsourced system development and also requires the organisation to direct that work.
This control depends on A.5.20.
IT.GOV-11.2 requires the organisation to maintain current assurance that suppliers continue to meet their cyber security commitments and to act when that assurance lapses. Those commitments must first be set, and ISO/IEC 27001 Annex A 5.20 is the control that establishes and agrees relevant information security requirements with each supplier. IT.GOV-11.2 therefore depends on Annex A 5.20, which addresses setting the requirements rather than assuring continued compliance with them.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-1567.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1567 sets one firm response, not using suppliers that a cyber supply chain risk assessment identifies as high risk.
This control partially overlaps ISM-1785.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1785 supports this by requiring a supplier relationship management policy to be developed, implemented and maintained.
This control partially overlaps ISM-1882.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1882 supports that assurance by procuring from suppliers with a demonstrated commitment to transparency for their products and services.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.