ASD ISM 1570 Regular IRAP assessment of cloud service providers
What it says
Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCloud service providers must undergo an IRAP review at least every 24 months.
Cloud service providers are like companies you hire to store or manage your data online. They need to be checked by an official program called IRAP at least every two years. This is important because if they don't measure up, your data might not be as secure as you think, leading to leaks or misuse that could hurt your business or reputation.
Free. Save your status, tasks and notes.
Why it matters
Without IRAP assessments at least every 24 months, cloud services may drift from ISM controls and retain undiscovered weaknesses, increasing breach risk for OFFICIAL: Sensitive to SECRET data.
How to implement
The IT manager should schedule a regular IRAP assessment for their outsourced cloud service providers.
Begin by contacting providers to understand their current IRAP review cycle and arrange an assessment if one isn't already scheduled. Use a calendar or project management tool to track assessment dates and follow-ups.
Procurement officers should ensure that new cloud service contracts require an IRAP assessment every 24 months.
When drafting contracts, specify this requirement in the vendor agreement terms and confirm understanding with the provider. Include timelines and responsibilities to ensure these assessments happen without delay.
The IT team should communicate with cloud service providers to verify that they undergo the latest ISM aligned IRAP assessments.
Prepare a checklist of ISM updates and seek confirmation from providers about compliance. Keep this information documented for future audits or reviews.
The compliance officer should review the outcomes of the IRAP assessments.
Gather reports from the service provider and ensure they meet organisational security standards. If gaps are found, work proactively with the provider to address them in a timely manner.
Management should allocate budget and resources for regular IRAP assessments as part of their annual planning.
Consider potential costs and incorporate them into financial projections to avoid resource shortages when assessments are due.
Keep it running
Schedule IRAP assessments for each cloud service at least every 24 months and ensure assessors use the latest ISM release available before the assessment starts (or a later release).
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of cloud service providers used by the organisation: Collect details of each provider including their current IRAP status.
Look at
The dates of last and next scheduled assessments for each provider.
Good evidence
Is a complete list showing recent or upcoming IRAP reviews.
- Check 2 of 5What an auditor asks for
Look at
Clauses that specify the necessity for IRAP assessments every 24 months.
Good evidence
Includes clear clauses that outline this requirement.
- Check 3 of 5What an auditor asks for
Ask for
To see the latest IRAP assessment reports from cloud service providers: Examine these reports for compliance with the latest ISM guidelines.
Good evidence
Is a report that shows no major security issues or a remedial plan in place.
- Check 4 of 5What an auditor asks for
Look at
How assessments are tracked, including scheduling and follow-up tasks.
Good evidence
Is a well-maintained log or dashboard indicating completed and outstanding reviews.
- Check 5 of 5What an auditor asks for
Good evidence
Includes clear records of ongoing communication and issue resolution if applicable.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.5.19.
ISM-1570 mandates periodic IRAP assessments for outsourced cloud service providers handling non-classified and classified data up to SECRET, providing formal assurance of cloud security posture. Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, and an IRAP report is a concrete input to those supplier risk processes. Annex A 5.19 covers the full lifecycle of supplier risk treatment (e.g. selection, contracting, ongoing controls), whereas ISM-1570 focuses specifically on independent assessment cadence and benchmark (ISM) for cloud services.
This control partially overlaps A.5.21.
ISM-1570 requires regular independent IRAP assessment of cloud service providers against the ISM, ensuring an objective security evaluation at least every 24 months. Annex A 5.21 requires processes to manage information security risks across the ICT supply chain, including suppliers and service providers that underpin service delivery. IRAP assessments can be used as supply-chain assurance evidence, but Annex A 5.21 is broader than cloud and includes upstream/downstream ICT components, while ISM-1570 is narrowly focused on cloud services and IRAP frequency.
This control partially overlaps A.5.22.
ISM-1570 requires outsourced cloud service providers and their relevant cloud services to undergo an IRAP assessment at least every 24 months against the latest ISM release. Annex A 5.22 requires an organisation to regularly monitor, review and evaluate supplier security practices and service delivery, which can be evidenced and strengthened through recurring independent assessments such as IRAP. However, Annex A 5.22 is broader across all suppliers and ongoing performance management, while ISM-1570 is a specific, time-bound assurance requirement for cloud providers via IRAP.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.