ASD ISM 1632 Ensure secure procurement from reliable suppliers
What it says
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong track record of maintaining the security of their own systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBuy technology from suppliers known for keeping their systems secure.
This control is about buying technology, like computers and software, from suppliers known for having good security. This is important because if these suppliers aren't secure themselves, your business could end up with vulnerable products that hackers could exploit, leading to data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
Purchasing from insecure suppliers risks receiving compromised technology, which can lead to data breaches or operational disruptions.
How to implement
Procurement staff should research suppliers before making a purchase.
They can do this by looking for supplier reviews, checking for security certifications, and asking for references from other customers. This will help ensure the supplier has a good reputation for security.
IT teams should verify that suppliers adhere to security standards.
This can be done by requesting documentation of their security practices, such as compliance with ISO/IEC 27001, which is an international standard for information security.
Managers should incorporate security criteria into the procurement process.
They can achieve this by adding specific security requirements into supplier agreements and contracts, ensuring suppliers commit to these standards.
HR should ensure staff involved in procurement are trained on identifying secure suppliers.
This can involve organising workshops or online training sessions that explain what to look for in a secure supplier.
Board members should regularly review procurement policies to ensure they emphasise secure sourcing.
This might include setting up annual reviews of procurement practices to align with emerging security threats and industry best practices.
Keep it running
Periodically assess suppliers' security posture, incident history and assurance evidence (e.g., audits) before purchase and renewal to reduce supply-chain compromise risk.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Procurement records of recent technology purchases.
Look at
The suppliers used and check for evidence that their security track record was assessed.
Good evidence
Is having documented proof of supplier evaluations and security certifications.
- Check 2 of 5What an auditor asks for
Look at
The methods used to evaluate suppliers' security.
Good evidence
Will show comprehensive risk assessments and decision documents.
- Check 3 of 5What an auditor asks for
Ask for
Training records of staff involved in procurement.
Look at
The contents of the training sessions related to secure procurement practices.
Good evidence
Includes detailed records of training topics and attendance.
- Check 4 of 5What an auditor asks for
Look at
Clauses that specifically mention adherence to security standards.
Good evidence
Will include contractual security obligations with clear terms.
- Check 5 of 5What an auditor asks for
Ask for
Meeting notes or records from security review meetings with suppliers.
Look at
The discussed issues and the actions taken to address them.
Good evidence
Includes clear records of meetings and documented resolutions.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-1632 requires organisations to procure operating systems, applications, equipment and services from suppliers with a strong track record of securing their own systems. Annex A 5.19 requires defining and implementing processes to manage information security risks across supplier relationships, which includes due diligence and supplier selection activities that would encompass choosing reputable, secure suppliers. ISM-1632 is a specific supplier-selection expectation, whereas Annex A 5.19 is broader across the full supplier relationship lifecycle (selection, onboarding, ongoing management and offboarding).
This control partially meets A.5.21.
ISM-1632 requires organisations to procure ICT/OT products and services from suppliers with a proven ability to maintain the security of their own systems. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, which includes supplier evaluation, assurance, monitoring, and handling of supply chain threats. ISM-1632 is one concrete supply-chain risk treatment (choosing reliable suppliers), while Annex A 5.21 has broader supply chain scope including upstream components, logistics, and systemic supply chain controls.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires ensuring supplier-provided AI dependencies align with responsible AI development and use. ISM-1632 overlaps by requiring procurement from suppliers with a strong security track record, reducing the chance that AI components (e.g., hosted models, MLOps tools, data pipelines) introduce vulnerabilities or enable tampering. ISM-1632 is limited to supplier security posture, while Annex A 10.3 also covers non-security responsible AI expectations such as transparency, bias management and use constraints.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-11.1Base supplier selection on proportionate cyber supply chain risk assessmentsPartially overlaps
This control partially overlaps IT.GOV-11.1.
IT.GOV-11.1 requires supplier selection based on a proportionate cyber supply chain risk assessment, retaining assurance evidence; ISM-1632 sets a specific selection criterion, procuring from suppliers with a strong track record of maintaining the security of their own systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.