ASD ISM 1738 Verify compliance with security requirements
What it says
The right to verify compliance with security requirements documented in contractual arrangements with service providers is regularly exercised.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly ensure service providers are following the security agreements in their contracts.
This control is about checking that service providers are doing what they promised in terms of security. It's important because if they slip up, your data and systems could be at risk, leading to data breaches or service disruptions.
Free. Save your status, tasks and notes.
Why it matters
If providers aren't following security agreements, you risk data breaches, financial loss, and damaged reputation.
How to implement
Procurement teams should review contracts with service providers to ensure they include clear security obligations.
Make sure these are specific about what security measures the provider must take.
IT managers should schedule regular compliance checks with each service provider.
Use a checklist based on the security terms in the contract and conduct these checks quarterly.
Assign an employee to be the main point of contact for service providers.
This person should keep track of communications and follow up on any security issues identified.
Security leaders should conduct training sessions for staff involved with contract management.
Focus on recognising security needs and how to enforce them through contracts.
Business managers should review reports from compliance checks.
Ensure that any issues are followed up and that providers are held accountable for improving their security posture.
Keep it running
Regular communication with service providers ensures they remain aware of their security obligations. Keep track of compliance issues and follow-ups.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the last compliance check report with service providers.
Look at
details on what was checked and what issues were found.
Good evidence
the report includes a checklist, findings, and corrective actions with timelines.
- Check 2 of 5What an auditor asks for
Good evidence
each contract has a dedicated section on security obligations with explicit terms.
- Check 3 of 5What an auditor asks for
Ask for
evidence of communication between the organisation and service providers about security issues.
Look at
documented emails or meeting minutes.
Good evidence
a series of emails or minutes showing issues raised and addressed.
- Check 4 of 5What an auditor asks for
Ask for
training records of staff involved in managing provider contracts.
Look at
details on date, content, and attendees.
Good evidence
recent training records demonstrating that relevant staff attended and understood contract security requirements.
- Check 5 of 5What an auditor asks for
Look at
a clear plan with dates and responsible persons.
Good evidence
a documented plan showing regular intervals and assigned employees for each check.
Mappings
Closest match in ISO/IEC 27001: A.5.20, Integrating security clauses in supplier agreements, which this control covers in full and more.
ISO/IEC 27001: 7 mappings
This control is broader than A.5.20.
Annex A 5.20 requires relevant information security requirements to be established and agreed with each supplier based on the relationship type. ISM-1738 mandates regular verification of a service provider's compliance with these requirements, making it narrower as it focuses on ongoing compliance verification rather than establishing initial requirements.
This control partially overlaps A.5.19.
ISM-1738 mandates regular verification of service provider compliance with contracted security requirements. ISO/IEC 27001:2022 Annex A 5.19 involves managing information security risks in supplier relationships, including assurance activities. While Annex A 5.19 is about broader risk management, it aligns with ISM-1738's focus on ongoing compliance verification.
This control partially overlaps A.5.21.
ISM-1738 requires regular, ongoing verification of service providers against contractual security requirements. ISO/IEC 27001:2022 Annex A 5.21 covers managing information security risks in the ICT supply chain, including supplier assurance and monitoring. Although Annex A 5.21 has a wider scope across supply chain risks, it relates to ISM-1738's focus on provider verification.
This control partially overlaps A.5.22.
Annex A 5.22 requires organisations to monitor and evaluate supplier practices and service delivery, including managing change. ISM-1738 relates by requiring the organisation to verify service provider compliance with documented security requirements. ISM-1738 focuses on compliance verification, while Annex A 5.22 is broader, covering service delivery performance and change management.
This control partially overlaps A.5.36.
Annex A 5.36 requires organisations to regularly review compliance with information security policies, rules and standards. ISM-1738 requires exercising the right to verify service provider compliance with security requirements in contracts, which is a concrete form of compliance verification in a supplier context. ISM-1738 is narrower (third-party contractual compliance verification), while Annex A 5.36 is broader and includes internal policy compliance across the organisation.
This control partially overlaps A.8.21.
Annex A 8.21 requires that security requirements for network services are identified and that implemented mechanisms and service levels are monitored. ISM-1738 supports this by ensuring the organisation regularly exercises its right to verify service provider compliance with contracted security requirements, which is a governance mechanism to assure third-party network services meet agreed requirements. ISM-1738 focuses on supplier assurance and contractual compliance, whereas Annex A 8.21 is broader and includes technical implementation and operational monitoring of the network services themselves.
This control partially overlaps A.8.30.
Annex A 8.30 requires directing, monitoring and reviewing outsourced system development activities on an ongoing basis. ISM-1738 supports this by requiring the organisation to regularly exercise its right to verify service provider compliance with security requirements, providing concrete assurance activities that feed monitoring and review. ISM-1738 is limited to exercising contractual verification rights, while Annex A 8.30 also includes setting direction and broader oversight of development practices and outputs.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.2.
Annex A 10.2 requires clear allocation of responsibilities for AI system life-cycle tasks across the organisation and third parties. ISM-1738 relates because exercising a contractual right to verify compliance depends on defining which party is responsible for meeting and evidencing security requirements. ISM-1738 is narrower (assurance/audit activity in supplier agreements), while Annex A 10.2 is broader in scope (all AI life-cycle responsibilities, not only verification of supplier compliance).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.