Skip to content
Procurement and outsourcing
ASD ISMISM-1073

ASD ISM 1073 Ensure provider contracts for system access

What it says

An organisation's systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Service providers need a contract before accessing or managing your systems.

This control ensures that before allowing a service provider to access or manage your organisation's systems, there must be a formal contract in place. This is important because without a contract, your business might be at risk of data breaches, misuse of systems, or unexpected costs if something goes wrong.

Why it matters

Without a contract, a provider may access/administer systems without defined security obligations, increasing breach and liability risk.

How to implement

  1. Business owners should work with the procurement team to ensure any service providers have a written contract before they can access your systems.

    Clearly spell out the access permissions and responsibilities in the contract to avoid misunderstandings.

  2. Managers should maintain a central record of all service provider contracts related to system access.

    Use this record to track and verify that all necessary contracts are in place before any system access is granted.

  3. The IT team should verify that no external providers can access organisational systems without approval.

    Implement a procedure to check for the existence of a valid contract as part of the access request process.

  4. HR should collaborate with procurement to create standard clauses for contracts with service providers concerning system access.

    These clauses should cover responsibilities, security requirements, and data protection measures.

  5. System administrators should regularly review current system access logs and match them against the list of contracted providers.

    If any discrepancies are found, initiate a review of access controls and contract validity.

Keep it running

Require written contracts before provider system access, defining scope, security clauses, and offboarding; review regularly for changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The register of all service provider contracts: Verify this document lists providers with access to systems, including contract dates and access details.

    Look at

    Comprehensive entries for each provider, detailing expiry and scope of access.

    Good evidence

    Includes complete and up-to-date details for each service provider.

  2. Check 2 of 5What an auditor asks for

    Look at

    Clear terms regarding the extent and duration of access.

    Good evidence

    Shows explicit permissions outlined for each provider.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The organisation's access request procedure: Examine how access is granted to service providers and verify contractual confirmation is part of the process.

    Look at

    Steps that include checks for contract validity before access approval.

    Good evidence

    A documented procedure that mandates contract checks before access is granted.

  4. Check 4 of 5What an auditor asks for

    Look at

    Alignment between logged access events and the list of contracted providers.

    Good evidence

    Confirms all access instances are by contracted service providers.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A review schedule of service provider contracts: Check if regular reviews of these contracts are in place to ensure continuing accuracy and relevance.

    Look at

    A schedule that specifies frequency and responsible parties for reviews.

    Good evidence

    Includes well-documented, timely reviews with evidence of recent checks.

Mappings

Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.5.19Managing information security in supplier relationshipsPartially meets
  • A.5.21Managing information security in the ICT supply chainPartially overlaps
  • A.5.22Monitoring and managing supplier servicesPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.