ASD ISM 1788 Identify multiple suppliers for critical IT sourcing
What it says
Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equipment and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure multiple suppliers are considered for sourcing essential IT systems and services to reduce supply chain risks.
When sourcing critical IT systems and services, it's important to have multiple suppliers lined up. This helps to protect against risks like a supplier going out of business or being unable to meet your needs, which could seriously disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Relying on a single supplier for critical IT services can severely disrupt operations if they fail to deliver, increasing supply chain risks.
How to implement
The procurement team should identify a list of potential suppliers for crucial IT components, such as operating systems and hardware.
They can start by researching and contacting various vendors to understand their capabilities and offerings.
The IT manager should develop a checklist of the criteria that suppliers need to meet.
This might include reliability, cost, and the ability to meet future demands. They can gather this information through meetings and proposals from each supplier.
The finance department should evaluate the financial stability of potential suppliers.
This can be done by reviewing credit reports or financial statements to ensure they are viable long-term partners.
The legal team should draft contracts with alternative suppliers to prepare for any disruptions.
This involves creating agreements that outline terms of service and contingencies in case the primary supplier fails to deliver.
Management should ensure regular reviews of supplier performance.
This can be done by setting up quarterly meetings where suppliers' service levels and any issues are discussed and documented.
Keep it running
Maintain at least two viable suppliers for critical OS/apps/equipment/services, and periodically reassess capability, lead times and financial viability.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of potential suppliers: Request documentation showing different vendors considered for sourcing IT systems and services.
Look at
Whether each supplier's capabilities and offerings align with your requirements.
Good evidence
Includes a dated list with summary evaluations for each supplier.
- Check 2 of 5What an auditor asks for
Ask for
Supplier vetting criteria: Request details on the standards used to evaluate potential suppliers.
Look at
How comprehensive and relevant these criteria are to your business needs.
Good evidence
Includes documented criteria covering reliability, cost, and support capabilities.
- Check 3 of 5What an auditor asks for
Ask for
Contracts or agreements: Request copies of any prepared or signed contracts with alternative suppliers.
Look at
The terms for service continuity and contingency plans.
Good evidence
Shows thorough, updated agreements with key failure scenarios covered.
- Check 4 of 5What an auditor asks for
Ask for
Financial reviews of suppliers: Request documentation of financial health checks performed on vendors.
Look at
Indicators of supplier stability, such as creditworthiness or significant financial metrics.
Good evidence
Has recent and detailed financial assessments attached.
- Check 5 of 5What an auditor asks for
Ask for
Records of supplier performance reviews: Request minutes or summaries from meetings about supplier performances.
Look at
The frequency, honesty, and thoroughness of these reviews.
Good evidence
Includes recent reviews with action points and improvements.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-1788 requires organisations to identify multiple potential suppliers for critical operating systems, applications, IT/OT equipment, and services to reduce supply chain risk and dependency. Annex A 5.19 requires defining and implementing processes to manage information security risks in supplier relationships, within which maintaining alternate/contingency suppliers is a common risk treatment for critical dependencies. ISM-1788 is a specific supply resilience measure, whereas Annex A 5.19 is broader and covers the full lifecycle of supplier relationship security governance beyond supplier plurality.
This control partially meets A.5.21.
ISM-1788 requires organisations to identify multiple potential suppliers for critical ICT/OT products and services to reduce concentration and disruption risk. Annex A 5.21 requires processes and procedures to manage information security risks across the ICT supply chain, which includes assessing supplier concentration risk and planning for alternate sourcing. ISM-1788 is a targeted control for multi-supplier identification, while Annex A 5.21 is broader and covers end-to-end ICT supply chain risk management (e.g. integrity, provenance, subcontractors, logistics).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.