ASD ISM 1395 Ensuring data protection by service providers
What it says
Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishService providers must protect any entrusted data adequately.
Service providers, like the companies that handle your data or host your website, need to keep your information safe. If they don't, your data could be misused, lost, or fall into the wrong hands, causing harm to your business or personal reputation.
Free. Save your status, tasks and notes.
Why it matters
Inadequate data protection by service providers can lead to data breaches, damaging reputation and risking client trust and legal action.
How to implement
Managers should carefully choose service providers that have a strong reputation for data security.
Research and compare options, and check customer reviews and independent security assessments before making a decision.
The procurement team should include detailed data protection requirements in contracts with service providers.
Specify security measures and responsibility for data breaches in the contract wording to ensure clarity and legal coverage.
IT managers should regularly audit the service providers to ensure they are meeting the security requirements.
This involves checking compliance with contractual obligations and requesting evidence of security practices.
Business decision-makers should set up regular meetings with service providers to discuss ongoing security improvements.
This can be done quarterly to ensure any new threats or vulnerabilities are being proactively managed and addressed.
Keep it running
Audit service providers and subcontractors (contracts, SLAs, attestations) to verify controls for handling, storage and disposal of your data meet requirements.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Contract documents with service providers that include data protection clauses.
Look at
Clear details about security obligations and the provider's responsibilities.
Good evidence
Contracts explicitly state the data protection measures and include penalties for non-compliance.
- Check 2 of 5What an auditor asks for
Look at
The assessment findings and any remedial actions taken.
Good evidence
Evidence that providers have been reviewed within the last year and any issues have been addressed promptly.
- Check 3 of 5What an auditor asks for
Ask for
Details on subcontractor management processes.
Look at
How service providers validate the security of their subcontractors.
Good evidence
Documentation showing subcontractors comply with the same standards as primary providers.
- Check 4 of 5What an auditor asks for
Look at
Discussions on security updates and risk management.
Good evidence
Regular engagement documented with action points and follow-up on identified issues.
- Check 5 of 5What an auditor asks for
Ask for
Security incident response plans involving service providers.
Look at
How incidents are reported and managed involving external providers.
Good evidence
A clear, tested plan that includes roles, responsibilities, and steps for both internal and service provider teams.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.
ISO/IEC 27001: 6 mappings
This control partially meets A.5.21.
Annex A 5.21 requires management of information security risks associated with ICT products and services throughout the supply chain. ISM-1395 relates by requiring service providers (and subcontractors) to provide an appropriate level of protection for data entrusted to them, addressing third-party data handling risk. ISM-1395 is a specific supplier assurance expectation, whereas Annex A 5.21 encompasses the full range of supply chain risk controls beyond data protection alone (e.g. integrity of delivered components and broader supplier governance).
This control partially overlaps A.5.19.
ISM-1395 requires that service providers (and subcontractors) provide an appropriate level of protection for entrusted data. Annex A 5.19 overlaps by requiring defined processes and procedures to manage information security risks arising from supplier products or services, which is the governance mechanism used to ensure providers protect entrusted information. Annex A 5.19 is broader in supplier-risk process coverage (risk management across supplier use), whereas ISM-1395 is specifically focused on the protection level applied to entrusted data.
This control partially overlaps A.5.22.
Annex A 5.22 requires monitoring and review of supplier security practices and service delivery, and managing changes affecting security. ISM-1395 overlaps by mandating that service providers protect data, which is a key aspect of monitoring and evaluation. ISM-1395 focuses on protection obligations, while Annex A 5.22 involves ongoing assurance and change management.
This control partially overlaps A.5.34.
ISM-1395 requires service providers to apply appropriate protection to data entrusted to them or their services. Annex A 5.34 overlaps where the entrusted data includes PII, requiring the organisation to meet privacy and PII protection obligations via law, regulation and contract, which are often flowed down to providers. Annex A 5.34 is limited to PII/privacy compliance, while ISM-1395 applies to entrusted data more broadly (not only PII).
This control partially overlaps A.8.30.
Annex A 8.30 requires directing, monitoring and reviewing outsourced system development to ensure security requirements are met by external developers. ISM-1395 requires service providers (including subcontractors) to provide an appropriate level of protection for data entrusted to them, which is often a key requirement in outsourced development arrangements. Annex A 8.30 is centred on controlling development activities and outcomes, whereas ISM-1395 is centred on data protection obligations irrespective of whether development is occurring.
This control supports A.5.20.
ISM-1395 requires service providers and subcontractors to protect any data entrusted to them or their services at an appropriate level. Annex A 5.20 supports this by requiring security requirements and clauses to be established and agreed in supplier agreements, which is a primary mechanism for mandating the expected protection level from providers. Annex A 5.20 is about contractual specification, while ISM-1395 is about the resulting protection outcome being achieved by the provider.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.