ASD ISM 1572 Document service provider data handling and change notifications
What it says
The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes, is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure service contracts specify data regions and notify configuration changes ahead of time.
This control ensures that when you use an external service for things like document storage or processing, you know exactly where your data is being kept and that any changes to how this service is configured are communicated to you in advance. This is crucial because if changes occur without your knowledge or if your data is stored in places with weak privacy laws, your business could be at risk of data breaches or legal issues.
Free. Save your status, tasks and notes.
Why it matters
Without documented regions/availability zones and change notice periods in contracts, data may be processed in unsuitable jurisdictions and provider changes may disrupt services without warning.
How to implement
The IT manager should set up a system to receive and track notifications from service providers about any configuration changes.
Establish a clear point of contact within your organisation to receive these notifications and ensure they are communicated to relevant staff in a timely manner.
The legal or compliance officer should review all contracts to ensure they contain a requirement for advance notice of any configuration changes.
Ensure that this period is realistic and provides enough time for your organisation to assess the impact of the changes.
System administrators should continuously monitor the compliance of service providers with the agreed contractual terms regarding data location and configuration changes.
Use regular check-ins or automated alerts to verify that data remains in agreed regions.
Communicate with your internal teams about the locations where your data is stored and any potential upcoming changes.
This can be done through regular meetings or updates, ensuring all key staff understand the implications of any changes in service provider configurations.
Keep it running
Ensure provider contracts explicitly state processing/storage/communication regions or availability zones and a minimum notice period for configuration changes; review on renewal and track change notices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The service contract documents: Request current agreements and terms of service with each provider.
Look at
The sections specifying data processing regions and notification requirements.
Good evidence
Contract clearly outlines these regions and includes a clause for advance notice of changes.
- Check 2 of 5What an auditor asks for
Ask for
Records of notifications received from service providers in the past year: Examine the notification logs or emails.
Look at
Evidence of timely advance notices for configuration changes.
Good evidence
Record should show that notifications were received well before changes took effect.
- Check 3 of 5What an auditor asks for
Ask for
Meeting minutes where data location and configuration change notices were discussed: Check the frequency and content of these meetings.
Good evidence
Meeting record indicates regular review and understanding of contracted data locations and any incoming changes.
- Check 4 of 5What an auditor asks for
Ask for
To see the monitoring reports from system administrators: Examine the logs or reports for evidence of ongoing data location monitoring.
Good evidence
Report contains regular checks against contract terms, including automated alerts for unauthorised changes.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records related to data handling and service provider management: Inspect these records to ensure all relevant staff are aware of data location issues and change notification processes. A comprehensive training record shows regular and targeted training sessions.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-1572 requires contractual arrangements with service providers to document the regions/availability zones where data is processed, stored and communicated, and to specify a minimum notification period for configuration changes. ISO/IEC 27001:2022 Annex A 5.19 relates by requiring defined and implemented processes to manage information security risks arising from supplier products or services, which commonly includes contracting for data residency and change notification. Annex A 5.19 is broader across supplier risk management, while ISM-1572 is a specific contractual requirement focused on data location transparency and advance notice of provider changes.
This control partially meets A.5.20.
ISM-1572 requires explicit supplier contract terms for data handling locations (regions/availability zones) and minimum advance notice for configuration changes. ISO/IEC 27001:2022 Annex A 5.20 directly relates by requiring relevant information security requirements to be established and agreed with each supplier, typically implemented via security clauses covering data residency and change management notifications. Annex A 5.20 is broader because it covers all relevant supplier security requirements, whereas ISM-1572 is a specific minimum set of clauses to include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.