ASD ISM 0731 CISO oversight of cyber supply chain risks
What it says
The CISO oversees cyber supply chain risk management activities for their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO is responsible for managing risks in their organisation's cyber supply chain.
The Chief Information Security Officer (CISO) needs to keep an eye on any risks that come from working with other companies or suppliers in relation to cyber security. This is really important because if a supplier has poor security, it can lead to stolen data, financial losses, or reputational harm to your organisation.
Free. Save your status, tasks and notes.
Why it matters
Without CISO oversight of supply chain risk, supplier weaknesses may go unmanaged, leading to breaches, data theft, and reputational and financial harm.
How to implement
The CISO should identify key suppliers: Make a list of all the companies your organisation relies on for technology and data services.
This includes companies that provide software, hardware, or data processing services.
The IT team should monitor supplier access: Keep track of any access to your systems that suppliers have.
Set up alerts for unusual access patterns or changes in system access.
The management team should develop a risk management plan: Work with the CISO to create a plan that outlines how your organisation will handle potential security issues with suppliers.
This plan should include steps for different scenarios, like a data breach.
Suppliers should be included in incident response exercises: Collaborate with suppliers during cyber security drills to ensure they know how to respond to incidents.
This helps improve coordination in case of a real security event.
Keep it running
Have the CISO set a cadence for supplier risk reporting, approve risk acceptances, and ensure supply chain risk assessments are updated when vendors or services change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of key suppliers: Request the document that lists all suppliers important for your organisation's IT services.
Look at
The details of each supplier, including their contact information and services provided.
Good evidence
Includes an up-to-date list with all suppliers' names, services, and contacts.
- Check 2 of 5What an auditor asks for
Ask for
Supplier security assessments: Request reports or records of the security evaluations conducted on suppliers.
Look at
The assessment dates and the results for each supplier.
Good evidence
Shows regular reviews with action points addressed.
- Check 3 of 5What an auditor asks for
Ask for
Monitoring logs of supplier access: Request the logs that show how and when suppliers access your systems.
Look at
The entries for unusual access attempts or changes.
Good evidence
Includes comprehensive logs with regular reviews and responses to any issues.
- Check 4 of 5What an auditor asks for
Ask for
To see the risk management plan for supplier-related risks: Request the document outlining your organisation's approach to handling supplier risks.
Look at
Specific scenarios covered and defined actions.
Good evidence
Includes a detailed plan with dates and responsible persons noted.
- Check 5 of 5What an auditor asks for
Ask for
To see records of incident response exercises involving suppliers: Request documentation that proves suppliers participate in incident response tests.
Look at
The scope and outcomes of these exercises.
Good evidence
Includes reports on completed exercises with supplier roles clearly defined.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control is broader than A.5.19.
ISM-0731 requires the CISO to oversee the organisation's cyber supply chain risk management activities. Annex A 5.19 mandates defined and implemented processes to manage information security risks in supplier relationships, which is a core component the CISO would oversee under ISM-0731. Annex A 5.19 focuses on operational supplier-risk processes, while ISM-0731 is a governance/oversight accountability requirement rather than the detailed process design itself.
This control is broader than A.5.22.
ISM-0731 requires CISO oversight of cyber supply chain risk management activities. Annex A 5.22 requires ongoing monitoring, review, evaluation, and change management of supplier security practices and service delivery, which is an operational control activity the CISO should ensure is performed under ISM-0731. Annex A 5.22 is procedural and continuous assurance-focused, while ISM-0731 is a governance role requirement.
This control partially meets A.5.21.
ISM-0731 requires the CISO to oversee cyber supply chain risk management activities for their organisation. Annex A 5.21 requires defined and implemented processes to manage information security risks associated with the ICT products and services supply chain, which is directly within the cyber supply chain scope the CISO oversees under ISM-0731. Annex A 5.21 specifies the need for supply-chain risk processes, whereas ISM-0731 specifies executive oversight and accountability rather than process detail.
This control partially overlaps A.8.30.
Annex A 8.30 requires the organisation to direct, monitor and review outsourced system development activities so security is maintained when development is performed externally. ISM-0731 requires CISO oversight of cyber supply chain risk management, which includes governance of risks introduced by outsourced developers and their dependencies. ISM-0731 is broader across supply chain risk domains beyond development delivery, while Annex A 8.30 is specifically focused on managing outsourced development execution and oversight.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.