ASD ISM 1790 Ensure integrity in IT and OT deliveries
What it says
Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their integrity.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDeliveries of IT and OT systems should be made securely to prevent tampering or integrity loss.
This control is about making sure that when you receive technology products or services, like computers or operating systems, they haven't been messed with or damaged before they reach you. If this isn't done properly, you could end up using equipment that doesn't work right, or worse, could be hacked to steal your information or harm your business.
Free. Save your status, tasks and notes.
Why it matters
Compromised deliveries can lead to tampered systems that expose sensitive data, disrupt operations, or enable cyber attacks.
How to implement
Procurement team should ensure trusted vendors: Choose suppliers who have a good track record and can provide secure delivery services for your IT and operational technology (OT) equipment.
Check their reputation and ask about their delivery methods to avoid tampering.
IT team should inspect deliveries: When new equipment arrives, check the packaging for any signs of tampering like broken seals or damaged boxes.
If something looks suspicious, don't use the equipment until you're sure it's safe.
System owner should verify integrity: Before using new systems, perform checks to ensure everything is as expected.
This includes running software checks or validation tools provided by the vendor to confirm no changes have occurred during delivery.
Managers should keep detailed records: Maintain a log of all deliveries received, including dates, vendors, and equipment details.
This helps track any issues and shows you're following proper procedures.
HR and training teams should educate staff: Organise training sessions to teach employees about the importance of secure deliveries and what to do if they spot something wrong.
This helps everyone play a part in keeping your systems safe.
Keep it running
Verify delivery integrity with hashes/signature checks, keep chain-of-custody records, and validate suppliers and packaging on receipt.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Vendor agreements and contracts: Request documents detailing the terms with vendors regarding secure delivery.
Look at
Clauses about integrity checks and delivery processes.
Good evidence
Includes clear commitments to secure deliveries.
- Check 2 of 5What an auditor asks for
Ask for
Delivery records: Request logs of recent equipment deliveries, showing inspection dates and findings.
Look at
Whether all entries are complete and whether any issues were reported and resolved.
Good evidence
Record is thorough and highlights how problems are fixed.
- Check 3 of 5What an auditor asks for
Ask for
To see inspection checklists: Request the form or checklist used by staff to verify the condition of deliveries upon receipt.
Look at
The detail recorded for each delivery.
Good evidence
Checklist details what was checked and how any suspicions were reported.
- Check 4 of 5What an auditor asks for
Ask for
Training materials: Request copies of materials used to train staff about the integrity of deliveries.
Look at
Content that covers how to identify tampering and proper response actions.
Good evidence
Means comprehensive training materials are regularly updated.
- Check 5 of 5What an auditor asks for
Ask for
Software validation reports: Request reports showing results of integrity checks or validation testing done on new systems.
Look at
Evidence that tests were performed soon after delivery.
Good evidence
Report confirms no issues found and matches vendor specifications.
Mappings
Closest match in ISO/IEC 27001: A.5.8, Information security in project management, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.8.
Annex A 5.8 requires information security to be integrated into project management so security requirements and checks are applied when delivering new or changed capabilities. ISM-1790 relates by requiring the integrity of delivered operating systems, applications, equipment and services, which is a specific security requirement often managed within procurement and delivery phases of projects. Annex A 5.8 is broader because it covers integrating security across all project activities, not only delivery integrity and supply/chain-of-custody considerations.
This control partially meets A.5.19.
ISM-1790 focuses on ensuring IT/OT deliveries arrive without tampering and with integrity preserved. Annex A 5.19 requires processes to manage information security risks in supplier relationships generally, which can include requirements for secure packaging, chain-of-custody and acceptance checks. The ISO control is broader because it covers the full supplier relationship lifecycle and multiple risk types, while ISM-1790 concentrates on the delivery integrity aspect.
This control partially meets A.5.21.
ISM-1790 requires operating systems, applications, IT/OT equipment and services to be delivered in a way that maintains integrity and prevents tampering in transit and handover. Annex A 5.21 addresses ICT supply chain security risk management across procurement, supplier selection, manufacture, delivery and support, which includes integrity protections for delivered products and services. ISM-1790 is one concrete supply-chain outcome (secure delivery integrity), whereas Annex A 5.21 is broader and covers end-to-end supply chain governance and risk treatment beyond delivery.
This control depends on A.5.22.
ISM-1790 requires that delivered IT/OT systems and services maintain integrity, implying controls such as tamper-evident delivery, verified provenance and secure handover. Annex A 5.22 strengthens this by requiring the organisation to monitor and review supplier service delivery and security practices, increasing the likelihood that delivery-integrity requirements are consistently met. Annex A 5.22 is ongoing supplier assurance, while ISM-1790 is the specific integrity requirement at the point of delivery and acceptance.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-16.1Verify integrity, authenticity and provenance of software, components and updates before usePartially overlaps
This control partially overlaps IT.PRO-16.1.
IT.PRO-16.1 requires the integrity and authenticity of software, components and updates to be assessed before use; ISM-1790 overlaps on integrity, requiring operating systems, applications, IT and OT equipment and services to be delivered in a manner that maintains their integrity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.