ASD ISM 1571 Verify security compliance in service contracts
What it says
The right to verify compliance with security requirements is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishContracts with service providers must include clauses that allow security compliance checks.
This control ensures that when you hire a service provider, your contract with them includes a clause that lets you check if they're doing their job securely. If you don't have this right, you might not be able to spot or fix problems when the provider's security fails, which could lead to data breaches or other serious issues.
Free. Save your status, tasks and notes.
Why it matters
Without a contractual right to verify/audit service providers, noncompliance may go undetected, increasing breach risk and legal exposure.
How to implement
Procurement officers should include a security compliance clause in all new service contracts.
This clause should explicitly grant your organisation the right to conduct security checks or audits on the service provider's operations related to your services.
Managers should communicate with current service providers to amend existing contracts.
They need to discuss the importance of this clause for ensuring security and aim to get an agreement in writing.
Legal teams should draft a standard compliance verification clause.
This clause should clearly outline your organisation's right to audit, what kind of checks can be performed, and how often these audits can occur.
IT and security teams should develop a checklist of security requirements for service providers.
This list should cover the necessary technical and procedural standards that providers must adhere to and regularly review it to ensure it's up to date.
Executive management should oversee the process to ensure that security checkpoints are in place for all service-based contracts.
This might involve setting up periodic reviews to ensure contracts remain compliant over their duration.
Keep it running
Ensure contracts explicitly grant rights to verify/audit security compliance (including evidence access). Schedule periodic audits and review attestations or reports.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Copies of contracts with service providers.
Look at
The sections that mention security compliance and audit rights.
Good evidence
Will be clear language granting the organisation audit rights and specifying the frequency and scope of audits.
- Check 2 of 5What an auditor asks for
Good evidence
Will detail the necessity of such clauses in every service provider contract.
- Check 3 of 5What an auditor asks for
Look at
Reports or findings that document these audits and any follow-up actions taken.
Good evidence
Includes dates, findings, remedial actions, and proof of completion.
- Check 4 of 5What an auditor asks for
Ask for
Descriptions of security training or awareness programs for procurement teams.
Look at
Evidence that these sessions cover the importance of compliance clauses in service contracts.
Good evidence
Will show regular training sessions and include a focus on compliance.
- Check 5 of 5What an auditor asks for
Look at
The details to see if all major contracts are covered.
Good evidence
Will be a comprehensive list showing all service providers with up-to-date compliance verification in their contracts.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control covers in full and more.
ISO/IEC 27001: 3 mappings
This control is broader than A.5.19.
ISM-1571 requires contractual arrangements to include the right for the organisation to verify a service provider's compliance with security requirements. Annex A 5.19 requires defined processes and procedures to manage information security risks in supplier relationships, which typically rely on contractual rights (e.g. audit/assessment rights) to execute assurance activities. Annex A 5.19 is broader because it covers end-to-end supplier risk management beyond contract wording, while ISM-1571 is a specific contractual assurance requirement.
This control partially meets A.5.20.
ISM-1571 requires that service provider contracts explicitly document the organisation's right to verify the provider's compliance with security requirements. Annex A 5.20 requires relevant information security requirements to be established and agreed within supplier agreements, which commonly includes audit, attestation and compliance verification clauses. Annex A 5.20 is broader because it covers establishing all relevant supplier security clauses, whereas ISM-1571 focuses specifically on the right to verify compliance.
This control supports A.5.22.
ISM-1571 requires service provider contracts include a documented right for the organisation to verify compliance with security requirements. Annex A 5.22 requires the organisation to monitor, review and evaluate supplier information security practices and service delivery, and exercising that monitoring often depends on having contractual audit/assessment rights. Annex A 5.22 is focused on ongoing supplier oversight, while ISM-1571 is focused on ensuring the contractual permission exists to perform that oversight.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.