ASD ISM 1736 Maintain and verify managed service register
What it says
A managed service register is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep and regularly check a log of managed services.
This control is about keeping a detailed log of all third-party services your business uses, like cloud providers or outsourced IT. It's important because without a clear record, you might overlook managing these services securely, leading to data breaches or service disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without a managed service register, unseen risks from third-party services can lead to data breaches, service outages, or compliance failures.
How to implement
The office manager should create a master list of all managed services used by the business, capturing each service provider's name, services offered, and contract terms.
This can be done using a simple spreadsheet.
The IT team should regularly review the list to confirm that all services are still necessary and meet security needs.
They can do this by setting a quarterly reminder to check each service's relevance and update any changes.
Each department head should report any new services they decide to use.
They can submit a form outlining the service's purpose and details to the office manager for inclusion in the register.
The procurement officer should ensure any new contracts or service agreements include privacy and security terms.
They can do this by having a checklist of security requirements to discuss with vendors during the negotiation phase.
The IT team should periodically conduct spot checks of the managed service register against actual deployed services, looking for any discrepancies.
This can involve cross-referencing against network or system inventories.
Keep it running
Regularly update and review the managed service register to keep track of all active services and ensure they meet your security requirements.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
the managed service register: Request the document or system that lists all third-party services in use by the organisation.
Look at
contract terms in the register: Check that security and privacy requirements are documented for each service.
- Check 2 of 4What an auditor asks for
Look at
recent activity: Ensure that the register has been updated within the last quarter to reflect current services.
- Check 3 of 4What an auditor asks for
Ask for
a change log or update history: Verify if there is a record showing who made updates and when, indicating the register is regularly maintained.
- Check 4 of 4What an auditor asks for
Ask for
a sample review meeting report.
Look at
notes from the last review meeting that verify the services on the register are still necessary and secure.
Mappings
Closest match in ISO/IEC 42001: A.10.3, Manage suppliers to support responsible AI use, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control supports A.5.21.
ISM-1736 requires organisations to maintain and regularly verify a register of managed services. This supports ISO/IEC 27001:2022 Annex A 5.21 because effective ICT supply chain risk management depends on knowing which external products and services are being used and who provides them. Annex A 5.21 extends beyond listing services into defining and operating risk management processes across the supply chain, whereas ISM-1736 is about establishing and validating the underlying service inventory.
This control supports A.5.22.
Annex A 5.22 requires regular monitoring, review and evaluation of supplier services and the management of changes in supplier delivery and security practices. ISM-1736 supports this by establishing and regularly verifying a managed service register, providing an authoritative inventory of supplier-provided services for the organisation to monitor and review. ISM-1736 is a governance mechanism enabling visibility and completeness.
This control depends on A.5.19.
ISM-1736 requires organisations to maintain a current, verified register of managed services. This supports ISO/IEC 27001:2022 Annex A 5.19 because managing information security risks in supplier relationships requires visibility of which supplier services exist, their owners, and their scope. Annex A 5.19 is broader and covers end-to-end supplier relationship controls (e.g. requirements, governance, assurance), while ISM-1736 primarily ensures the register exists and is kept accurate.
ISO/IEC 42001: 1 mapping
This control partially meets A.10.3.
Annex A 10.3 requires a process to ensure managed services and supplier deliverables used in AI align with responsible AI development and use. ISM-1736 is a prerequisite subset by requiring a maintained and regularly verified managed service register, which identifies where AI-relevant third-party services exist (e.g., hosted AI platforms, external model endpoints, data labelling services) so they can be governed. ISM-1736 is an inventory control and does not require assessment or enforcement of responsible-AI criteria that Annex A 10.3 mandates.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.