Skip to content
Evaluated products
ASD ISMISM-0285

ASD ISM 0285 Ensuring evaluated products follow delivery procedures

What it says

Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Products must be delivered according to any specified delivery methods in evaluation documents.

When you've evaluated a product and decided to buy it, make sure it's delivered following any specific instructions outlined in evaluation documents. This matters because improper delivery might compromise the product's integrity or functionality, leading to operational hiccups or security vulnerabilities.

Why it matters

Improper delivery of evaluated products can compromise integrity, leading to potential security breaches and operational failures.

How to implement

  1. Procurement team should review the evaluation documents: Identify any delivery guidelines specified for a product.

    This involves checking any requirements about how the item should be packaged, shipped, or received.

  2. IT manager should coordinate with vendors: Once requirements are identified, communicate these delivery specifications clearly to the supplier.

    Ensure that the supplier acknowledges and confirms understanding of these requirements.

  3. Receiving personnel should verify deliveries upon arrival: Use a checklist based on the specified delivery methods in the evaluation documents.

    Check packaging integrity, shipping method, and any conditions detailed in the requirements.

  4. System owner should document the delivery process: Capture details of how the product was delivered, including any deviations from the specified methods.

    Use a simple form to record each step from dispatch to receipt.

  5. Team lead should conduct regular checks of delivery procedures: Schedule periodic reviews of recent deliveries against documented requirements.

    Discuss any discrepancies in team meetings to prevent future issues.

Keep it running

Regularly verify delivery procedures align with evaluation documents to prevent security and functionality issues.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The evaluation documents: Request the documentation outlining the delivery methods for the evaluated products.

    Look at

    The specifics of how products should be delivered.

    Good evidence

    Includes clearly outlined steps or conditions for delivery.

  2. Check 2 of 5What an auditor asks for

    Look at

    A log or report detailing how each product was delivered according to the specified methods. Check for any discrepancies between expected and actual procedures.

    Good evidence

    Log shows adherence to all evaluation requirements.

  3. Check 3 of 5What an auditor asks for

    Ask for

    How they ensure vendors adhere to specified delivery instructions.

    Good evidence

    Shows they have a checklist and a process for communicating requirements to suppliers.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Observation would see thorough inspection and proper documentation of receipt.

  5. Check 5 of 5What an auditor asks for

    Look at

    Clear communication of the specific delivery conditions.

    Good evidence

    Includes an email thread confirming the vendor understands and agrees to these conditions.

Mappings

Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.19Managing information security in supplier relationshipsPartially meets
  • A.5.21Managing information security in the ICT supply chainPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.