ASD ISM 1786 Maintain an approved supplier list
What it says
An approved supplier list is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure a list of approved suppliers is created, used, and kept updated.
Having an approved supplier list is about knowing which companies or service providers are safe and reliable to work with. This matters because using an unapproved supplier could mean dealing with poor service, delays, or even giving sensitive information to the wrong people, potentially harming your organisation's reputation and security.
Free. Save your status, tasks and notes.
Why it matters
Without an approved supplier list, organisations may onboard unvetted vendors, increasing supply-chain risk, breaches, and disruptions.
How to implement
Managers should create a list of suppliers that the organisation can safely use.
Start by gathering recommendations from staff who regularly deal with suppliers, then review their past performance and reliability.
The procurement team should check and update this supplier list regularly.
This can be done by scheduling quarterly reviews and confirming that each supplier continues to meet the organisation's standards.
Before adding a new supplier to the list, procurement officers should do a background check.
This might involve reviewing their financial stability, checking references from other clients, and ensuring they comply with any relevant industry standards.
Ensure all staff know to only use suppliers from the approved list.
Train employees by providing an overview of the approved supplier list during staff meetings and reminding them of the importance of using these trusted partners.
The finance department should monitor all invoices to ensure payments are only made to approved suppliers.
This can be done by cross-referencing every invoice received with the approved supplier list before payment is authorised.
Keep it running
Maintain an approved supplier list by adding security/compliance checks, periodic reviews, and removing suppliers that fail reassessment.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current approved supplier list: Request the document or system where this list is maintained.
Look at
The list to ensure it is current and includes all necessary supplier details.
Good evidence
A comprehensive, up-to-date list with recent review dates and correct contact information.
- Check 2 of 5What an auditor asks for
Ask for
Documentation of the supplier approval process: Request to see records of how suppliers are assessed and approved.
Look at
Evidence of a consistent evaluation process applied to each supplier.
Good evidence
Clear records showing assessment criteria and approval based on objective, well-documented standards.
- Check 3 of 5What an auditor asks for
Ask for
Records of quarterly reviews of the supplier list: Request documents showing when the last reviews took place and by whom.
Look at
Consistent review intervals and actions taken based on review findings.
Good evidence
Dated records of regular reviews showing updates made or confirmations that the list remains current.
- Check 4 of 5What an auditor asks for
Ask for
Staff training records about supplier use: Request documents or logs of training sessions where employees were informed about the supplier list.
Look at
Details on who attended and what topics were covered.
Good evidence
Recent training logs showing wide attendance and clear emphasis on using only approved suppliers.
- Check 5 of 5What an auditor asks for
Ask for
A sample of recent supplier invoices: Request copies of invoices from the past few months.
Look at
Whether all suppliers invoicing the organisation are on the approved list.
Good evidence
Invoices that all map back to the approved supplier list, demonstrating correct procurement practices.
Mappings
Closest match in ISO/IEC 27001: A.5.20, Integrating security clauses in supplier agreements, which this control covers in full and more.
ISO/IEC 27001: 4 mappings
This control is broader than A.5.20.
ISM-1786 requires an organisation to maintain an approved supplier list to control which suppliers can be engaged. ISO/IEC 27001:2022 Annex A 5.20 focuses on agreeing and embedding security requirements in supplier agreements, which is broader contract governance across all supplier relationships. An approved supplier list (ISM-1786) supports applying consistent contractual clauses, but Annex A 5.20 extends well beyond listing suppliers to the content and enforcement of contractual security requirements.
This control is broader than A.5.22.
ISM-1786 requires an organisation to implement and maintain an approved supplier list. ISO/IEC 27001:2022 Annex A 5.22 requires ongoing monitoring, review, evaluation and management of change in supplier security practices and service delivery, which generally assumes the organisation has identified which suppliers are in scope. ISM-1786 provides the baseline governance (who is approved), while Annex A 5.22 is broader and focuses on continual oversight of those suppliers' performance and security posture.
This control partially meets A.5.19.
ISM-1786 requires an organisation to develop, implement and maintain an approved supplier list. ISO/IEC 27001:2022 Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, which typically includes identifying/approving suppliers and maintaining visibility of who is permitted to provide products or services. ISM-1786 is a specific governance mechanism within the broader supplier risk management processes required by Annex A 5.19.
This control partially meets A.5.21.
ISM-1786 requires an organisation to create and maintain an approved supplier list to control supplier engagement. ISO/IEC 27001:2022 Annex A 5.21 requires processes to manage ICT supply chain information security risks across products and services, including supplier selection, assurance, and ongoing risk treatment. ISM-1786 is one specific supply chain control that contributes to Annex A 5.21, but does not cover the full set of ICT supply chain risk activities.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires a process to ensure supplier inputs and services used by AI systems align with responsible AI development and use. ISM-1786 overlaps by requiring an approved supplier list, which is a governance mechanism to enforce supplier selection based on criteria that can include AI safety, transparency, data provenance and misuse controls. ISM-1786 is an artefact/control for supplier approval, whereas Annex A 10.3 additionally requires AI-specific alignment checks across the supplier lifecycle (selection, contracting, monitoring and change).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.