ASD ISM 0072 Document security requirements in contractual arrangements
What it says
Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and regularly reviewed to ensure they remain fit for purpose.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInclude security needs in contracts with service providers and review them to ensure they meet current standards.
This control is about making sure your service contracts include rules to keep your data safe and reviewing them regularly to ensure they're still good. If you don't do this, sensitive information might leak, or you could lose access to important data when you need it most.
Free. Save your status, tasks and notes.
Why it matters
Without these precautions, data could be exposed or inaccessible, harming business operations and reputation.
How to implement
Procurement teams should include specific security clauses in all contracts with service providers.
This can be done by consulting with IT experts to list the data protection requirements necessary for confidentiality and availability.
Managers should regularly review these contracts to ensure they still meet current standards.
Set a calendar reminder every six months to check if there have been changes in technology or regulations that affect your security needs.
The IT team should work with the procurement team to update any contracts whenever new threats or vulnerabilities are identified.
Conduct a security risk assessment when new services are added or existing ones significantly change.
Legal advisors should be involved to ensure these contracts legally bind the service providers to the agreed security standards.
Include representatives from legal and compliance to review any updates to ensure no detail is overlooked.
Service providers should be contacted if terms are not met.
Establish a communication line with the providers to address issues quickly, ensuring there's a clear process to mitigate risks if any breach occurs.
Keep it running
Continuously monitor changes in both legal requirements and technology to keep contractual security needs current and effective.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the latest copy of contracts with the service providers: Verify that security requirements are documented.
Look at
specific clauses around data protection measures.
Good evidence
shows clear, tailored security requirements documented and signed by all parties.
- Check 2 of 5What an auditor asks for
Ask for
to see any notes or documentation from regular contract reviews: Check whether reviews are scheduled and completed on time.
Look at
calendars or logs showing the dates and findings of reviews.
Good evidence
lists reviews every six months with findings documented.
- Check 3 of 5What an auditor asks for
Ask for
evidence of communication with service providers regarding security expectations.
Look at
emails or meeting records.
Good evidence
includes dated communication logs demonstrating discussion of security needs.
- Check 4 of 5What an auditor asks for
Ask for
records of security risk assessments.
Look at
evaluation results that might necessitate updating contracts.
Good evidence
includes a report outlining potential risks with proposed contract adjustments.
- Check 5 of 5What an auditor asks for
Ask for
notes or minutes from meetings involving legal and procurement teams: Ensure discussions on contract updates are documented.
Good evidence
includes clear records showing contract changes were reviewed by legal experts.
Mappings
Closest match in ISO/IEC 27001: A.5.20, Integrating security clauses in supplier agreements, which asks for the same thing.
ISO/IEC 27001: 6 mappings
This control is equivalent to A.5.20.
Annex A 5.20 requires information security requirements to be agreed with each supplier. ISM-0072 matches this by mandating documentation of confidentiality, integrity, and availability requirements in contracts, reviewed regularly.
This control is broader than A.5.21.
Annex A 5.21 requires processes and procedures to manage information security risks arising from ICT suppliers and service dependencies. ISM-0072 relates by mandating that confidentiality, integrity and availability requirements are documented in service provider contracts and reviewed regularly. Contractual security requirements are an important mechanism under Annex A 5.21, but the ISO control also covers broader supply chain activities such as supplier evaluation, assurance, and ongoing risk monitoring.
This control partially overlaps A.5.19.
Annex A 5.19 requires organisations to define and implement processes to manage information security risks arising from supplier products and services. ISM-0072 relates by mandating that confidentiality, integrity, and availability security requirements are documented in service provider contracts and reviewed regularly, a key mechanism for managing supplier risk. ISM-0072 is contract-specific, whereas Annex A 5.19 is broader, including due diligence, monitoring, assurance activities, and governance beyond contractual terms.
This control partially overlaps A.5.36.
Annex A 5.36 requires organisations to regularly review compliance with information security policies, rules and standards. ISM-0072 requires security requirements in service provider contracts to be documented and reviewed regularly to ensure they remain fit for purpose, which overlaps with reviewing adherence to security requirements (a type of standard/requirement). ISM-0072 is narrower and supplier-specific and emphasises fitness-for-purpose of contractual requirements, while Annex A 5.36 is organisation-wide and focused on compliance with internal policy and standards.
This control partially overlaps A.6.6.
Annex A 6.6 requires the organisation to identify, document, regularly review and obtain signed confidentiality or non-disclosure agreements (NDAs) from personnel and other relevant interested parties. This overlaps with ISM-0072 because both controls require security expectations to be captured in formal contractual instruments and kept current through regular review. Specifically, confidentiality obligations are a common contractual requirement in service provider agreements. ISM-0072 is limited to service provider contractual arrangements and extends beyond confidentiality to include integrity and availability requirements, while Annex A 6.6 is focused on NDAs/confidentiality agreements across a broader set of parties.
This control supports A.5.22.
Annex A 5.22 requires monitoring, review and evaluation of supplier practices against expectations, and to manage changes. ISM-0072 is a prerequisite by requiring documentation of security requirements in contracts and regular reviews, providing the baseline criteria for Annex A 5.22's activities.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.2.
Annex A 6.2.2 requires documenting requirements for new AI systems or material enhancements, often including external services, data handling, and constraints. ISM-0072 mandates documenting security requirements in service provider contracts and reviewing them for fitness for purpose. They overlap when AI system requirements must flow down into contractual security requirements, especially for vendors handling AI components.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.