Skip to content
Procurement and outsourcing
ASD ISMISM-1737

ASD ISM 1737 Recording required details for each managed service in the register

What it says

A managed service register contains the following for each managed service: - managed service provider's name - managed service's name - purpose for using the managed service - sensitivity or classification of data involved - due date for the next security control assessment of the managed service - contractual arrangements for the managed service - organisational point of contact for the managed service - 24/7 contact details for the managed service provider.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Your managed service register must hold eight specific details per service, from provider and purpose through to assessment due dates, contracts and 24/7 provider contacts.

This control sets out exactly what your organisation must record for every managed service it uses. For each service, the register needs eight things: the managed service provider's name, the managed service's name, why you use it, the sensitivity or classification of the data involved, the due date for the next security control assessment of the service, the contractual arrangements, an organisational point of contact, and 24/7 contact details for the provider. It matters because a managed service means someone outside your organisation is running part of your environment, often with access to your data. When something goes wrong at 2am, you need to know who runs the service, what data it touches, who owns the relationship internally and how to reach the provider immediately. When assessments fall due, you need to know when. When a dispute or renewal arises, you need the contractual arrangements at hand. A register that only lists provider and service names, without the rest, leaves gaps that surface at the worst possible moment.

Why it matters

If the register is missing any of the required fields, your organisation may be unable to reach the provider quickly during an incident, may not know which services handle classified or sensitive data, and may let security control assessments lapse because no due date was recorded. Contractual terms may be unknown when they are needed most, and nobody may be clearly accountable for the service internally. Each gap slows response and weakens your ability to demonstrate oversight of third parties.

How to implement

  1. The register owner (for example the IT manager or vendor management lead) should build the register with one mandatory column or field for each of the eight items in the statement: provider name, service name, purpose, data sensitivity or classification, next security control assessment due date, contractual arrangements, organisational point of contact, and 24/7 provider contact details.

  2. The person onboarding a new managed service should complete every one of the eight fields before the service goes live, using the procurement paperwork and contract to source the provider name, contractual arrangements and provider escalation details.

  3. The information security team should record the sensitivity or classification of data involved for each service by checking what data the provider will process, store or access, and aligning the entry with the organisation's classification scheme.

  4. The assurance or security lead should enter the due date for the next security control assessment of each managed service and roll it forward each time an assessment is completed, so the field always shows a future date.

  5. The register owner should confirm the organisational point of contact and the provider's 24/7 contact details at a set interval (for example quarterly) by contacting each named person or number and updating the entry where details have changed.

Keep it running

Day to day, the register is a living record rather than a one-off document. Whenever a managed service is onboarded, changed or offboarded, the entry should be created or updated with all eight fields completed. Points of contact change as staff move roles, provider escalation numbers change as providers restructure, and assessment due dates roll forward once an assessment is completed, so the owner of the register needs a routine for keeping these current.

Treat the data sensitivity or classification field as a prompt for how carefully the rest of the entry is handled, and treat the assessment due date as a trigger for scheduling work. The 24/7 provider contact details should be verified periodically so they actually work when needed. Access to the register itself should be limited to those who need it, as it describes where sensitive data sits and how to reach providers.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the current managed service register.

    Look at

    Check that the register has a field for each of the eight items in the statement and that every managed service entry has all eight populated.

    Good evidence

    Every entry lists provider name, service name, purpose, data sensitivity or classification, next assessment due date, contractual arrangements, an organisational point of contact and 24/7 provider contact details, with no blanks.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the contract or agreement for a sample of managed services listed in the register.

    Look at

    Compare the provider name, service name and contractual arrangements recorded in the register against the actual contract documents.

    Good evidence

    The register entries match the contracts, and the contractual arrangements field points to or summarises the real agreement rather than a placeholder.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask how the due date for the next security control assessment is set and maintained for each managed service.

    Look at

    Look at the recorded due dates and any evidence of completed assessments to see whether dates have been rolled forward after each assessment.

    Good evidence

    Each service has a future assessment due date recorded, and past assessments show the date was updated afterwards rather than left to expire.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for the organisational point of contact and the 24/7 provider contact details for a sample of services.

    Look at

    Check that the named internal contact is a current staff member and that the provider contact details are specific, reachable and intended for round-the-clock use.

    Good evidence

    Internal contacts are current employees who confirm their role, and provider 24/7 details are real escalation channels rather than a generic sales address.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask how the purpose and data sensitivity or classification were determined for each managed service.

    Look at

    Review whether the purpose describes what the service is used for and whether the sensitivity or classification matches the organisation's classification scheme and the data actually involved.

    Good evidence

    Each entry states a clear business purpose and a classification consistent with the organisation's scheme, supported by the person who assessed the data involved.

Mappings

Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.

ISO 27001

ISO/IEC 27001: 5 mappings

  • A.5.19Managing information security in supplier relationshipsPartially meets
  • A.5.9Inventory management of information and associated assetsPartially overlaps
  • A.5.20Integrating security clauses in supplier agreementsPartially overlaps
  • A.5.21Managing information security in the ICT supply chainSupports
  • A.5.22Monitoring and managing supplier servicesSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.