ASD ISM 1791 Assess integrity of delivered IT and OT products
What it says
The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck the integrity of IT and OT products before accepting them to ensure they're safe and reliable.
Before you accept new IT gadgets or systems into your business, it's crucial to make sure they are safe and trustworthy. If you skip this step, you might end up with faulty or compromised equipment that could put your data at risk or lead to expensive downtime.
Free. Save your status, tasks and notes.
Why it matters
Failing to assess delivered product integrity enables supply-chain tampering or counterfeit IT/OT gear, leading to compromise, outages and costly rework.
How to implement
Procurement team should include a security assessment clause in contracts: Specify in every purchase contract that IT and OT (operational technology) products must undergo a security check before acceptance.
This ensures vendors are aware of and adhere to your security expectations from the start.
IT team should inspect all new technology arrivals: Before connecting new equipment, software, or systems to your existing network, conduct a detailed inspection to spot any tampering or unexpected alterations.
This can include checking software versions and verifying device seals and packaging.
HR or management should train relevant staff on recognition: Host a short workshop to educate staff about the importance of inspecting delivered technology and how to recognise potential red flags in deliveries.
This will empower them to act as the first line of defence.
The IT department should maintain an inventory record: Start and regularly update a log of all incoming IT and OT products, noting their condition, supplier details, and inspection results.
Keeping track of this information can help quickly identify and resolve any issues.
Management should schedule regular review meetings: Hold periodic meetings with relevant teams, including procurement and IT, to review and discuss recent deliveries, any inspection findings, and improvements in procedures.
Document outcomes for future reference.
Keep it running
At acceptance, verify provenance, serials and tamper seals; validate vendor signatures/hashes and firmware integrity, and quarantine any delivery anomalies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The vendor contracts: Verify they include a clause requiring integrity checks for all IT and OT products.
Look at
The text to ensure it mandates detailed checks before acceptance.
Good evidence
Is contracts with a clear security assessment requirement.
- Check 2 of 5What an auditor asks for
Good evidence
Has comprehensive entries without gaps.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Review the records to confirm staff have been trained on delivery checks.
Look at
Attendance lists or certificates of completion.
Good evidence
Includes documented evidence of staff participation in training sessions.
- Check 4 of 5What an auditor asks for
Look at
Notes highlighting decisions and action items.
Good evidence
Shows regular meetings with actionable outcomes.
- Check 5 of 5What an auditor asks for
Ask for
Examples of inspection reports: Examine these for completeness and depth in checking products.
Look at
Consistent follow-up on identified issues and resolutions.
Good evidence
Has detailed reports, indicating thorough inspections were conducted.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
ISM-1791 requires organisations to assess the integrity of delivered IT/OT operating systems, applications, equipment and services as part of acceptance. Annex A 5.19 requires defining and implementing processes to manage information security risks in supplier relationships, which includes setting acceptance criteria and verification activities such as integrity checking. Annex A 5.19 is broader across the whole supplier relationship lifecycle, whereas ISM-1791 is focused specifically on integrity assessment at delivery/acceptance.
This control partially meets A.5.21.
ISM-1791 requires integrity assessment of delivered IT/OT products and services before acceptance. Annex A 5.21 addresses managing information security risks across the ICT supply chain, which commonly includes controls for product authenticity, tamper detection, and acceptance verification. Annex A 5.21 has wider scope across sourcing, logistics and upstream suppliers, while ISM-1791 is the acceptance-stage integrity check within that broader supply chain management.
This control partially overlaps A.8.29.
ISM-1791 requires assessing the integrity of delivered IT and OT products and services as part of acceptance. Annex A 8.29 requires security testing in development and acceptance, which can include validation that delivered software/components are genuine and unmodified before go-live. Annex A 8.29 is oriented to SDLC security testing (often for internally developed or integrated solutions), while ISM-1791 applies broadly to delivered operating systems, applications, and physical IT/OT equipment regardless of development origin.
This control partially overlaps A.8.30.
Annex A 8.30 requires the organisation to direct, monitor and review outsourced system development activities to maintain security and quality. ISM-1791 strengthens this by requiring integrity assessment as part of acceptance of delivered products and services, which is a practical review/assurance step for outsourced development deliverables. ISM-1791 focuses on acceptance testing and integrity verification, while Annex A 8.30 covers broader governance across the outsourced development lifecycle (direction, ongoing monitoring, and review).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-16.1Verify integrity, authenticity and provenance of software, components and updates before usePartially overlaps
This control partially overlaps IT.PRO-16.1.
IT.PRO-16.1 requires the integrity and authenticity of software, components and updates to be assessed before use; ISM-1791 covers the integrity part, assessing the integrity of operating systems, applications, IT and OT equipment and services as part of acceptance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.