ASD Essentials IT.PRO-16.2 Monitor Vendor Advisories and Threat Intelligence to Act on Supply Chain Exposure
What it says
Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWatches vendor warnings and threat reports for suppliers, products or components exposed to compromise, and acts as fast as the risk requires.
The team follows vendor security notices and threat reports. It checks each one against the suppliers, products and parts in use. To meet this, each notice is assessed and acted on within set timeframes, faster for bigger risks. A confirmed breach of a supplier or product in use becomes an incident and goes in the risk register. For example, the team might patch, isolate a system or hunt for signs of a break-in.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
Without this watch, a tampered update or breached supplier can stay active in key systems long after vendors warn about it. Acting late lets attackers keep hidden access, such as a backdoor on a web server that survives patching.
How to implement
The threat intelligence lead (whoever tracks threats) should subscribe to each relevant supplier's security notices and ASD's alerts.
Keep a list of what each source covers, and load the published warning signs, such as bad web addresses, into monitoring tools.
IT operations and system owners should record the suppliers, products, versions, parts and services in use.
Add software parts lists (bills of materials) where suppliers provide them, so each notice can be matched quickly.
The head of security should approve timeframes for checking if anything in use is affected and starting a response.
Set shorter ones for higher risks, such as active attacks or internet-facing systems, and name who sorts notices and who decides.
Security analysts should check each notice against the record of what is in use, and log the decision.
Start the response within the set timeframe, such as applying the fix, rolling back a version or isolating a system.
The incident response lead should open an incident for any breach of something in use and stop it spreading within the set timeframe.
Search logs for the published warning signs, then update the risk register and response procedures.
Keep it running
Security operations puts every notice and threat report into one queue with a named owner, and records each decision and its timeframe. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems. A common trap is closing a confirmed breach once it is patched or isolated, without looking for signs that attackers got in.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of notice sources and the record of what is in use.
Look at
Compare the two for products or services no source covers, or sources too general to be useful.
Good evidence
Monitoring covers everything in use, using sources relevant to those suppliers and products.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the approved timeframes for assessing and responding to affected suppliers or products.
Look at
Whether timeframes are written down and scale with risk, or are missing or the same for everything.
Good evidence
Approved timeframes scale with the risk, and responses to confirmed breaches meet them.
- Check 3 of 5What an auditor asks for
Ask for
Request records for a sample of recent notices, including one affecting internet-facing or sign-in systems.
Look at
Whether notices were read but never assessed, or decisions and responses ran past the timeframes.
Good evidence
Every relevant notice gets a decision on exposure and, where needed, an on-time response.
- Check 4 of 5What an auditor asks for
Ask for
Ask for incident records of a recent supplier or product breach, or the latest practice run.
Look at
Whether it was contained and then searched for signs of attack, or closed once patched.
Good evidence
Each breach is contained and checked for signs of attack, and the findings are recorded.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the incident response plan and the risk register entries for supplier or product breaches.
Look at
Whether such breaches are a defined incident type, or past events are missing from the register.
Good evidence
Breaches go through incident response and the risk register, and lessons update procedures.
ASD indicators of good practice (12)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(4)
- NE-1No monitoring is performed for indicators of supply chain compromise affecting software, components or services in use.
- NE-2Vendor security notifications and threat advisories are not reviewed or actioned.
- NE-3When supply chain compromise is identified, neither containment nor investigation is performed.
- NE-4Supply chain compromise events are integrated into neither incident response nor risk management.
Partially effective(4)
- PE-1Monitoring occurs but does not draw on relevant threat intelligence sources or does not cover all in-scope systems.
- PE-2Notifications and advisories are reviewed but exposure assessment and response are not conducted in a timely manner.
- PE-3Containment occurs but investigation for evidence of exploitation is not consistently undertaken.
- PE-4Some integration exists but findings are not reflected in the risk register or incident response procedures.
Fully effective(4)
- FE-1Monitoring covers software, components and services in use, drawing on relevant threat intelligence sources.
- FE-2Vendor security notifications and threat advisories are reviewed, exposure is assessed and response actions are initiated within defined timeframes.
- FE-3Identified supply chain compromises are responded to in timeframes defined by the organisation.
- FE-4Supply chain compromise events are integrated with incident response and reflected in the risk register.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing Information Security in the ICT Supply Chain, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.21.
IT.PRO-16.2 requires vendor advisories and threat intelligence to be used to maintain awareness of supplier, product and component exposure to compromise, and to act within timeframes proportionate to the risk. This is a specific monitoring and response activity within the processes ISO/IEC 27001 Annex A 5.21 requires to manage information security risks associated with the ICT products and services supply chain. Annex A 5.21 covers the full supply chain risk process, while IT.PRO-16.2 concentrates on tracking and responding to compromise.
This control partially overlaps A.8.8.
IT.PRO-16.2 requires vendor advisories and threat intelligence to be used to maintain awareness of supplier, product and component exposure to compromise, with action taken within timeframes proportionate to the risk. This overlaps with ISO/IEC 27001 Annex A 8.8, which requires information about technical vulnerabilities to be obtained, exposure evaluated and appropriate measures taken. IT.PRO-16.2 also covers compromise of suppliers beyond technical vulnerabilities, while Annex A 8.8 covers vulnerabilities in all systems in use regardless of their source.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-2116.
IT.PRO-16.2 requires using vendor advisories and threat intelligence to track supplier, product and component exposure to compromise and act in risk-proportionate timeframes; ISM-2116 also uses cyber threat intelligence services, but to detect cyber security events and identify incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.