ASD ISM 1631 Identify suppliers in cyber supply chain
What it says
Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all suppliers linked to IT and OT systems are identified for security management.
This control is about knowing exactly who your suppliers are when it comes to your IT and operational technology systems. Knowing your suppliers is crucial because if you don't, you might be blindsided by vulnerabilities in the softwares or machines you rely on. This can lead to system failures, data breaches, or disruptions in service, costing your business time, money, and reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to identify all suppliers can lead to unassessed risks from third-party vulnerabilities, potentially causing breaches and operational disruptions.
How to implement
The office manager should create a comprehensive list of all current suppliers who provide software, hardware, and other IT services.
Start by gathering contracts, invoices, and any documentation from past purchases to ensure no supplier is missed.
The IT team should verify each supplier's role and the systems they are connected to.
They can do this by reviewing system configurations and talking to staff responsible for different technologies to see where these products are used.
Procurement officers should vet any new suppliers before onboarding them.
They should check each potential supplier's cyber security practices, such as how they protect data and whether they routinely update and patch their software.
HR should provide ongoing training for staff to understand the importance of vetting suppliers and recognising potential risks associated with third-party partnerships.
The manager should organise regular reviews with the IT team and procurement to update and re-evaluate the supplier list.
This could be done quarterly to ensure the company is aware of any changes in supplier security postures.
Keep it running
Maintain an up-to-date register of all OS, application, IT/OT equipment and service suppliers supporting each system; review changes on procurement and renewals.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The master supplier list: Request a document listing all suppliers linked to IT and OT systems.
Look at
The supplier names, their products or services, and contract details.
Good evidence
Shows a complete and up-to-date list with clear indications of their involvement in the organisation's systems.
- Check 2 of 5What an auditor asks for
Ask for
Supplier vetting criteria.
Look at
Documents detailing what criteria are used to choose and approve suppliers.
Good evidence
Includes evidence of security checks, such as assessments of their data protection measures.
- Check 3 of 5What an auditor asks for
Ask for
To see supplier contracts: Review contracts for clauses on data protection, updating of software, and breach notification.
Good evidence
Is contracts that include specific terms outlining the supplier's security responsibilities.
- Check 4 of 5What an auditor asks for
Ask for
Recent meeting minutes between procurement and IT.
Look at
Discussions about supplier performance and security implications.
Good evidence
Is documented evidence of regular reviews and decisions made regarding supplier management.
- Check 5 of 5What an auditor asks for
Ask for
Staff cyber security awareness training records.
Look at
Records showing training sessions covering supplier-related risks.
Good evidence
Includes agendas or attendance records from sessions focusing on third-party risk management.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
Annex A 5.19 requires organisations to manage information security risks associated with using supplier products or services through defined processes and procedures. ISM-1631 supports this by requiring organisations to identify relevant suppliers in the cyber supply chain, which is a foundational input to assessing and managing those risks. ISM-1631 is limited to identification, while Annex A 5.19 extends to risk treatment, controls, and ongoing management across the supplier relationship lifecycle.
This control supports A.5.20.
ISM-1631 requires organisations to identify suppliers linked to operating systems, applications, IT/OT equipment and services associated with systems. ISO/IEC 27001:2022 Annex A 5.20 requires establishing and agreeing security requirements with each supplier in agreements, which presupposes the organisation has identified those suppliers. ISM-1631 does not address contractual clauses, but it provides the necessary supplier list to apply Annex A 5.20 consistently.
This control supports A.5.22.
ISM-1631 requires organisations to identify all relevant suppliers in the cyber supply chain for systems and services. ISO/IEC 27001:2022 Annex A 5.22 requires organisations to monitor, review and manage changes in supplier security practices and service delivery, which depends on having a defined set of suppliers to monitor. ISM-1631 is limited to identification, while Annex A 5.22 focuses on ongoing assurance and change oversight.
This control depends on A.5.21.
ISM-1631 requires organisations to identify all suppliers associated with systems (e.g. OS, applications, IT/OT equipment and services) so they can be managed as part of the cyber supply chain. ISO/IEC 27001:2022 Annex A 5.21 requires defined processes to manage ICT supply chain information security risks, which practically depends on having an accurate supplier inventory. While ISM-1631 focuses on supplier identification, Annex A 5.21 extends further into risk management processes across the supply chain.
ISO/IEC 42001: 1 mapping
This control partially meets A.10.3.
Annex A 10.3 requires a supplier management process to ensure supplier services/products/materials used for AI align with responsible AI development and use. ISM-1631 supports this outcome by requiring suppliers in the cyber supply chain to be identified, enabling the organisation to apply AI-specific due diligence and constraints to the right third parties (e.g., model/API providers, data vendors, annotators). ISM-1631 stops at identification, while Annex A 10.3 requires evaluation, acceptance criteria and ongoing assurance against responsible-AI objectives.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-11.1Base supplier selection on proportionate cyber supply chain risk assessmentsPartially overlaps
This control partially overlaps IT.GOV-11.1.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1631 is a prerequisite step, identifying the suppliers of operating systems, applications, IT and OT equipment and services associated with systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.