ASD ISM 1785 Develop and maintain supplier management policy
What it says
A supplier relationship management policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure a policy is in place for managing relationships with suppliers in a consistent manner.
This control is about having a clear policy on how your organisation manages its relationships with suppliers. Imagine running a business where each supplier does their own thing without clear guidelines from you; it can lead to misunderstandings, missed expectations, or even security risks if they're handling sensitive information. A good policy keeps everyone on the same page and ensures your organisation doesn't get caught off guard by supplier issues.
Free. Save your status, tasks and notes.
Why it matters
Without a supplier relationship management policy, third-party access and contract requirements may be inconsistent, increasing data leakage and service outage risk.
How to implement
Procurement team should develop a supplier management policy: Gather your team and draft a document that outlines how your organisation will manage and interact with suppliers.
Include criteria like performance expectations, data security requirements, and contract terms.
Managers should identify key suppliers: Review all current suppliers and assess their importance to your organisation.
Focus on those whose failure would significantly impact your business operations or security.
HR and IT departments should work together: Ensure the policy includes training for employees responsible for supplier relations.
This can be achieved by creating a training schedule and inviting experts to explain the expectations and guidelines clearly.
The legal team should review contracts: Check that all supplier agreements comply with the new policy.
Amend contracts to clearly state data protection requirements and performance metrics as necessary.
The leadership team should periodically review the policy: Schedule regular meetings, perhaps quarterly, to discuss any changes needed in the policy due to changes in business goals or external factors like new regulations.
Keep it running
Define supplier due diligence, contract security clauses, third-party access approvals and offboarding steps; review the policy regularly to reflect supplier and risk changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The supplier management policy document: Request to see the formal document outlining the policy.
Look at
The clarity and comprehensiveness of the guidelines included.
Good evidence
Shows step-by-step management processes and expectations in plain language.
- Check 2 of 5What an auditor asks for
Ask for
A list of key suppliers: Request documentation showing identified priority suppliers.
Look at
How suppliers are chosen and categorised.
Good evidence
Will explain the criteria for their selection and prioritisation.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request records showing attendance and material used in training sessions related to supplier management.
Look at
Evidence that staff responsible for supplier interactions attended the training.
Good evidence
Includes participant names, dates, and summary of what was covered.
- Check 4 of 5What an auditor asks for
Ask for
A sample supplier contract: Request a copy of a supplier contract with data security clauses.
Look at
Clear terms about information security and performance metrics included in the contract.
Good evidence
Will include clauses directly linking back to the policy.
- Check 5 of 5What an auditor asks for
Ask for
Meeting minutes on policy reviews: Request notes or minutes from the leadership meetings about policy reviews.
Look at
Evidence of regular reviews and updates in reaction to internal or external changes.
Good evidence
Shows documented decisions and reasoning for any modifications.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.19.
Annex A 5.19 requires defined and implemented processes and procedures to manage information security risks from suppliers' products and services. ISM-1785 relates by requiring a supplier relationship management policy to be developed, implemented, and maintained, providing governance and structure for managing supplier security. ISM-1785 is policy-centric, while Annex A 5.19 emphasises operational processes, procedures, and risk management outcomes.
This control depends on A.5.20.
ISM-1785 requires an organisation to establish and maintain a supplier relationship management policy. Annex A 5.20 supports ISM-1785 by specifying that information security requirements must be established and agreed with each supplier via security clauses in supplier agreements, which is a common policy requirement and implementation mechanism. ISM-1785 is broader at the policy level, whereas Annex A 5.20 is a specific contractual control focusing on agreed security requirements per supplier.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires an organisational process to ensure suppliers used for AI align with responsible AI development and use. ISM-1785 overlaps by requiring a supplier relationship management policy, providing the governance framework under which AI supplier due diligence, contracting requirements and ongoing monitoring can be defined. ISM-1785 is policy-level and cyber supply-chain oriented, while Annex A 10.3 demands AI-specific alignment outcomes (e.g., provenance, safety testing, and acceptable-use constraints) rather than policy existence alone.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.GOV-11.2.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1785 supports this by requiring a supplier relationship management policy to be developed, implemented and maintained.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.