ASD ISM 1568 Ensure security commitment from suppliers
What it says
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to the security of their products and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBuy IT and OT products only from suppliers who show they care about product security.
This control means that when you buy technology products or services, you should only choose suppliers who show they prioritise the security of what they sell. This is important because if the suppliers don't care about security, their products might be more vulnerable to hacking. If something goes wrong, it could cost your business time, money, or even your reputation.
Free. Save your status, tasks and notes.
Why it matters
Procurement from lax suppliers can introduce vulnerable products into your network, increasing the risk of costly breaches and reputation damage.
How to implement
Procurement officers should identify suppliers who are committed to security.
They can do this by looking for suppliers who have security certifications or who are known to follow best industry practices. This can be done by checking supplier websites or asking directly for any security-related certifications or standards they comply with.
Managers should establish a pre-qualification process for suppliers.
This involves setting criteria that suppliers must meet to be considered, such as having security policies in place and a track record of handling data responsibly. Managers can create a checklist that assesses these elements and ensure it is checked before finalising any purchase.
The IT team should review the security features of products before they are purchased.
This involves looking at technical specifications provided by suppliers and ensuring they meet the organisation's security needs. They can also ask suppliers about any recent security audits or vulnerabilities that have been uncovered and addressed.
Purchasing staff should seek out recommendations and reviews from other customers.
By contacting other businesses or reading reviews that focus on product security, the purchasing team can identify any recurring issues with security in a supplier's products. This can be done via online forums or through networking at industry events.
Leadership should periodically review supplier performance and their commitment to security.
This includes setting regular meetings to discuss supplier security and requiring suppliers to report on their ongoing security improvements. This ensures that the relationship with suppliers is continually assessed and that they stay committed to security.
Keep it running
Vet supplier security commitments via questionnaires, certifications and audit evidence before purchase, and re-assess key suppliers regularly to confirm secure development and support practices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The supplier's security certifications or standards compliance document.
Look at
The dates and the organisations that conducted the certifications.
Good evidence
Will show current certifications from recognised bodies such as ISO or NIST.
- Check 2 of 5What an auditor asks for
Good evidence
A detailed list with specific security consideration points for each supplier.
- Check 3 of 5What an auditor asks for
Ask for
Records of the latest product security review conducted by the IT team.
Look at
Which products were reviewed, their specific security features, and responses to any vulnerabilities.
Good evidence
Is a detailed report showing thorough assessments and any actions taken as a result.
- Check 4 of 5What an auditor asks for
Look at
Evidence of positive feedback or resolved complaints about security issues.
Good evidence
Includes multiple instances of peer businesses vouching for the security of the supplier's products.
- Check 5 of 5What an auditor asks for
Ask for
To see records of periodic supplier performance evaluations.
Look at
How frequently these evaluations occur and the specific security metrics being tracked.
Good evidence
Includes recent evaluations with clear improvement actions agreed upon between the organisation and the supplier.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
Annex A 5.19 requires processes and procedures to manage information security risks associated with suppliers' products and services. ISM-1568 relates by requiring procurement from suppliers who demonstrate a commitment to the security of their products and services, which is one risk treatment approach within supplier management. ISM-1568 is focused on supplier selection and procurement criteria, whereas Annex A 5.19 covers the full supplier relationship lifecycle, including ongoing assurance and management.
This control partially meets A.5.21.
ISM-1568 requires organisations to procure operating systems, applications, IT/OT equipment and services from suppliers that have demonstrated a commitment to security. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, including upstream dependencies, sub-suppliers, component integrity and broader supply chain assurance. ISM-1568 fits within this larger supply chain risk management concept, but is narrower because it focuses on supplier security commitment at procurement rather than end-to-end ICT supply chain risk.
This control partially overlaps A.5.20.
ISM-1568 requires organisations to buy IT/OT products and services only from suppliers that can demonstrate a commitment to security. Annex A 5.20 focuses on establishing and agreeing information security requirements in supplier agreements, which is a common mechanism to evidence and enforce that supplier commitment. ISM-1568 emphasises supplier selection/assurance evidence at procurement, whereas Annex A 5.20 emphasises contractualising requirements (which can apply even where the supplier's inherent commitment is uncertain).
This control depends on A.8.26.
ISM-1568 requires organisations to procure applications and technology from suppliers that demonstrate a commitment to secure products and services. Annex A 8.26 supports this by requiring security requirements to be identified, specified and approved when acquiring (or developing) applications, giving concrete criteria to assess suppliers and products during procurement. ISM-1568 is supplier-assurance focused, while Annex A 8.26 is requirements-definition focused and can be applied regardless of supplier maturity.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires supplier management to ensure AI dependencies are responsibly developed and used. ISM-1568 overlaps by requiring procurement from suppliers committed to product/service security, which is foundational to trustworthy AI operations (protecting model integrity, data confidentiality and availability). ISM-1568 addresses security commitment only, while Annex A 10.3 extends to broader responsible-AI expectations such as transparency, safety validation and appropriate-use safeguards.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-11.1Base supplier selection on proportionate cyber supply chain risk assessmentsPartially overlaps
This control partially overlaps IT.GOV-11.1.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1568 sets one selection criterion, procuring from suppliers that have demonstrated a commitment to the security of their products and services.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.