ASD ISM 1574 Data portability in service contracts
What it says
The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure service contracts cover data portability for backups, migration, and decommissioning.
This control is about making sure that your business data can be easily moved or backed up when using services like cloud storage. It's important because if your provider goes down or if you switch services, you want your data safe and away from being stuck or lost.
Free. Save your status, tasks and notes.
Why it matters
Without data portability, your business risks losing access to crucial information, facing operational delays, and financial losses if you change or leave a service provider.
How to implement
Procurement teams should ensure that contracts with service providers include clear clauses about data portability.
Do this by specifying how and when data can be extracted or transferred during and after the contract.
IT managers should work with service vendors to test data migration and backup processes.
They can create small test data sets to perform a mock transfer, ensuring compatibility with other systems.
Legal teams should review all service agreements for compliance with data portability requirements.
They should check that there are no hidden fees or barriers that prevent easy data transfer.
Managers should establish a regular review schedule for service contracts to assess data portability clauses.
This can be done annually to ensure that the clauses still meet business needs and legal requirements.
Operational staff should maintain an inventory of systems and services to track where data resides.
Use this inventory to ensure you know how data can be retrieved or moved if needed.
Keep it running
Regularly review and update service contracts to ensure they include terms that facilitate easy data portability and conformity with legal standards.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the service contract agreements: Request to see documents that outline data portability clauses with service providers.
Look at
sections detailing how and when data can be migrated or backed up.
Good evidence
includes clear, non-restrictive terms about data transfer rights.
- Check 2 of 5What an auditor asks for
Ask for
evidence of successful data migration tests: Request reports or logs of any recent data migration or backup tests performed.
Look at
details on the timing and success of the data transfers.
Good evidence
shows no data loss and documents how the process was completed.
- Check 3 of 5What an auditor asks for
Ask for
the inventory of data assets used in service contracts: Review how data assets are listed and managed.
Look at
comprehensive details about data location and portability options.
Good evidence
inventory provides clarity on all data managed by third-party services.
- Check 4 of 5What an auditor asks for
Ask for
periodic review meeting records: Request minutes or reports from meetings held to discuss contract reviews.
Look at
what actions were taken concerning data portability.
Good evidence
includes documented discussions and decisions made on maintaining or improving portability.
- Check 5 of 5What an auditor asks for
Ask for
legal compliance checks: Request documentation of legal reviews for service contracts.
Look at
evidence of compliance with Australian regulations related to data transfer.
Good evidence
includes legal sign-offs and compliance confirmations.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-1574 requires organisations to document data portability expectations (backup, migration, and decommissioning without data loss) in contracts with service providers. Annex A 5.19 requires establishing processes to manage information security risks in supplier relationships, which includes identifying and managing risks of vendor lock-in, poor exit processes, and loss of data during migration. Annex A 5.19 is broader supplier security governance, while ISM-1574 is a specific contractual requirement covering portability and exit outcomes.
This control partially overlaps A.5.14.
ISM-1574 requires contractual arrangements with service providers to document portable data storage arrangements that support backups, service migration and decommissioning without data loss. Annex A 5.14 requires information transfer rules/procedures/agreements for information transfers within the organisation and between the organisation and other parties, which includes supplier transfer arrangements. Annex A 5.14 is broader across all transfer types and channels, while ISM-1574 is specifically about data portability and lifecycle outcomes (backup, migration, exit) being contractually defined.
This control supports A.8.13.
ISM-1574 requires supplier contracts to document portable storage arrangements that enable backups and restoration/migration without losing data. Annex A 8.13 requires backup copies and regular testing in line with the organisation's backup policy, which provides the operational backup capability that ISM-1574 expects to be contractually supported by providers. Annex A 8.13 does not require supplier agreement clauses or portability/exit terms, but it strengthens the feasibility of meeting ISM-1574's backup and recoverability expectations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.