ASD ISM 1575 One-month notice for service termination
What it says
A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishService contracts require a one-month notice before a provider can stop services.
When you have a contract with a service provider, this control ensures that if they plan to stop providing their services, they must give you at least one month's notice. This is crucial because unexpected service stoppage can disrupt your business operations, leading to financial loss and potential harm to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If contracts lack a documented one‑month termination notice, services may stop abruptly, disrupting operations and causing unplanned cost and reputational damage.
How to implement
Business owners should verify that all new contracts include a clause requiring a one-month notice period before services can be terminated.
This can be done by reading through the contract thoroughly and confirming this term is clearly stated.
Procurement officers should work with legal advisors to align new service agreements with this requirement.
They should review the contracts before signing to ensure the termination clause is included and correctly worded.
IT managers should document all critical services their organisation relies on and ensure each has a one-month termination clause in the service agreements.
This involves creating a checklist for reviewing contracts of each service provider.
Office managers should maintain a calendar of contract renewal and termination dates to track when notices should be sent or received.
Setting reminders a month before critical dates can help ensure compliance with this requirement.
Executives should communicate with their teams regularly to discuss any upcoming service terminations and manage any transition smoothly.
Holding monthly review meetings to discuss current contracts and potential impacts helps to keep everyone informed.
Keep it running
Include a documented minimum one‑month cessation notice clause in each provider contract, and review contracts periodically to confirm it remains in force.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the standard service agreement template.
Look at
The termination clause details.
Good evidence
Includes a clear statement requiring a minimum one-month notice for termination.
- Check 2 of 5What an auditor asks for
Look at
Whether each contract contains the specified one-month termination notice clause.
Good evidence
Shows all contracts having this clause properly documented.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of any recent service terminations.
Look at
The notice period that was actually given to the service provider.
Good evidence
Includes documentation showing at least one month's notice was provided.
- Check 4 of 5What an auditor asks for
Look at
Mentions of the termination clause being discussed and agreed upon.
Good evidence
Shows these details were actively negotiated and agreed on in writing.
- Check 5 of 5What an auditor asks for
Ask for
The organisation's contract management process documentation.
Look at
Steps for ensuring termination notice requirements are met and tracked.
Good evidence
Shows clear procedures for reviewing and approving service terminations according to contract terms.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-1575 requires a documented minimum one-month notification period for a supplier to cease services, written into service provider contracts. This relates to ISO/IEC 27001:2022 Annex A 5.19 because exit and continuity risks from suppliers (including termination conditions) are part of managing supplier-related information security risks. Annex A 5.19 is broader, covering the overall supplier risk management framework beyond termination notice periods.
This control partially meets A.5.20.
ISM-1575 requires contracts with service providers to include a documented minimum one-month notice period before services can be terminated. This directly aligns with ISO/IEC 27001:2022 Annex A 5.20, which requires integrating relevant information security requirements as clauses within supplier agreements. Annex A 5.20 is broader because it covers all security clauses (e.g. access, incident notification, audit rights), whereas ISM-1575 specifies one particular contractual clause about termination notice.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.