ASD ISM 1452 Perform supply chain risk assessments for system suppliers
What it says
A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system's security risk profile.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAssess each supplier of operating systems, applications, IT and OT equipment, and services to understand how they affect your system's security risk.
When you buy software, hardware, or services from outside suppliers, those suppliers can introduce risks into your systems without you realising it. This control asks you to run a supply chain risk assessment, which simply means checking each supplier of operating systems (the core software a device runs on, like Windows), applications (everyday programs), IT equipment (computers and network gear), OT equipment (operational technology, meaning machinery and devices that control physical equipment), and services, and working out how that supplier changes your overall security risk. The goal is to know the risk before it becomes a problem, not after.
Free. Save your status, tasks and notes.
Why it matters
Engaging suppliers without assessing them can let a weak vendor become the entry point for a breach, so a hidden third-party flaw quietly raises your whole system's risk.
How to implement
The person responsible for procurement should build a register listing every supplier of operating systems, applications, IT equipment, operational technology (OT) equipment, and services, so you have a complete picture of who can affect your systems.
The IT or security lead should create a short, repeatable assessment form that captures each supplier's security practices, where they are based, who they subcontract to, and how a failure on their end would affect your systems.
Before signing any new contract, the manager approving the purchase should require a completed supply chain risk assessment for that supplier and record the resulting risk rating (for example low, medium, or high).
For each supplier rated medium or high, the security lead should document the specific impact to the system's security risk profile, meaning exactly which systems and data are exposed and how badly, so the business can decide whether to proceed.
The business owner or board should set a schedule to re-run these assessments at least annually and whenever a supplier changes ownership, suffers a breach, or takes on a more critical role.
Keep it running
Keep the supplier register and assessments current, and re-run an assessment whenever a supplier is added, changes ownership, suffers an incident, or takes on a more critical role.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the supplier register and the completed risk assessments.
Look at
coverage across all five categories named in the control: operating systems, applications, IT equipment, OT equipment, and services.
Good evidence
is a register where every active supplier in these categories has a dated assessment, not just a handful of big vendors.
- Check 2 of 5What an auditor asks for
Ask for
how the organisation decides which suppliers get assessed.
Look at
the documented criteria or scope.
Good evidence
shows a clear rule (for example, all suppliers touching production systems or sensitive data) rather than an ad hoc, memory-based selection.
- Check 3 of 5What an auditor asks for
Ask for
to see how a supplier's impact on the system's security risk profile is recorded.
Look at
an actual risk rating and a description of which systems and data are affected.
Good evidence
links each supplier to concrete consequences, not a generic statement that 'all suppliers are low risk'.
- Check 4 of 5What an auditor asks for
Ask for
when assessments were last reviewed and what triggers a re-assessment.
Look at
the dates and any records of reassessment after a supplier change or incident.
Good evidence
shows assessments are current (within the last year) and were refreshed when something material changed.
- Check 5 of 5What an auditor asks for
Ask for
who signs off on a supplier once the assessment is done.
Look at
evidence that an accountable manager reviewed and accepted the risk before the supplier was engaged.
Good evidence
shows named approval tied to each assessment, especially for medium and high risk suppliers.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control is equivalent to A.5.21.
ISM-1452 requires a supply chain risk assessment for suppliers of operating systems, applications, IT/OT equipment and services to determine the impact on a system's security risk profile. Annex A 5.21 requires defined and implemented processes to manage information security risks in the ICT products and services supply chain, which directly aligns with performing and using supply chain risk assessments. ISM-1452 is explicit about assessing supplier impact to a system's risk profile (including OT), while Annex A 5.21 is framed more generally around managing ICT supply chain risk via processes and procedures.
This control partially meets A.5.19.
ISM-1452 requires organisations to perform supply chain risk assessments across suppliers of operating systems, applications, IT/OT equipment and services to determine impacts to the system's security risk profile. Annex A 5.19 requires processes and procedures to manage information security risks in supplier relationships, under which supplier risk assessment is a core method. ISM-1452 is therefore a specific requirement within the broader supplier-relationship risk management expectations of Annex A 5.19.
This control partially overlaps A.5.22.
Annex A 5.22 requires the organisation to regularly monitor, review and evaluate supplier information security practices and service delivery, and to manage changes in those supplier services. ISM-1452 involves supply chain risk assessments for IT/OT suppliers to understand how supplier choices and changes affect the system's security risk profile. The overlap lies in ongoing supplier risk evaluation, with ISM-1452 focusing on risk assessment during selection/procurement and significant changes.
This control partially overlaps A.8.30.
Annex A 8.30 requires directing, monitoring and reviewing outsourced system development, which inherently involves managing third-party delivery risk. ISM-1452 requires performing a supply chain risk assessment for suppliers of systems, applications, equipment and services, which includes assessing risks associated with outsourcing development to a supplier. ISM-1452 is broader (covering many supplier types and impacts to a system's risk profile), while Annex A 8.30 is more operationally focused on oversight of outsourced development activities once sourced.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires managing suppliers to ensure AI-related services/products/materials align with responsible AI development and use. ISM-1452 overlaps by requiring supply chain risk assessments to determine impact on a system's security risk profile, which applies to third-party AI models, data sources, MLOps tooling and hosting. ISM-1452 is primarily security-risk profiling, while Annex A 10.3 additionally requires assessment against responsible-AI risks (e.g., bias, safety, transparency and misuse potential).
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-11.1Base supplier selection on proportionate cyber supply chain risk assessmentsPartially overlaps
This control partially overlaps IT.GOV-11.1.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1452 requires that assessment itself for suppliers of operating systems, applications, IT and OT equipment and services, gauging impact on system risk.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.