ASD ISM 1792 Assess authenticity of IT and OT deliveries
What it says
The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that software and equipment are genuine before accepting them.
This control means you need to make sure any software or equipment you're using is the real deal, not a fake or compromised version. This is important because if you use counterfeit systems, they might have hidden vulnerabilities or malware that can lead to data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
If deliveries are not authenticated, counterfeit IT/OT systems or software can be introduced, creating hidden vulnerabilities and causing breaches and downtime.
How to implement
Procurement staff should verify authenticity: Before purchasing, they should check that vendors are legitimate by cross-referencing with trusted sources or using accredited suppliers.
This prevents buying counterfeit or unauthorised products.
IT managers should conduct authenticity checks: Use manufacturer-provided tools or contact the vendor to verify serial numbers and product authenticity after delivery.
This helps ensure the product hasn't been tampered with or replaced with a knock-off.
Operations staff should keep records: Document the authenticity verification process, including who did it, how, and when, and store this information securely.
This creates a paper trail to prove due diligence.
Management should establish policies: Develop clear guidelines requiring staff to follow specific steps for authenticity checks.
Regular training sessions should reinforce the importance of these procedures.
IT team should implement monitoring: Use tools to continuously monitor the integrity of installed systems and applications.
This can help detect unauthorised changes or tampering after the initial deployment.
Keep it running
Regularly verify suppliers and perform checks on deliveries to authenticate equipment and software, preventing integration of counterfeit items.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Proof of procurement checks: Request records that show how suppliers were verified before purchase.
Look at
Supplier accreditation or comparison against known trusted provider lists.
Good evidence
Includes documentation showing criteria used for assessment.
- Check 2 of 5What an auditor asks for
Ask for
Records of authenticity checks: Request logs or reports from the IT team detailing how software and equipment authenticity was verified.
Look at
How checks were conducted and evidence of vendor confirmation.
Good evidence
Includes time-stamped verification reports.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request attendance logs or training materials on how staff should verify authenticity.
Look at
Evidence of regular training sessions and updated materials.
Good evidence
Shows comprehensive training with attendance tracked.
- Check 4 of 5What an auditor asks for
Ask for
Policy documents: Request the organisation's policy on authenticity verification.
Look at
Clear procedural steps and responsibilities outlined in the document.
Good evidence
Shows a detailed, regularly updated policy.
- Check 5 of 5What an auditor asks for
Ask for
Monitoring reports: Request a summary of monitoring activities carried out by the IT team.
Look at
Logs of activity monitoring that can detect technical issues or tampering.
Good evidence
Includes periodic monitoring reports with documented findings.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.21.
ISM-1792 requires organisations to assess the authenticity of operating systems, applications, IT/OT equipment and services as part of accepting products and services. Annex A 5.21 requires defining and implementing processes to manage information security risks across the ICT supply chain, which includes preventing counterfeit or tampered products entering the environment. ISM-1792 is a specific acceptance/verification activity within the broader supply chain risk management set expected by Annex A 5.21.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-16.1Verify integrity, authenticity and provenance of software, components and updates before usePartially overlaps
This control partially overlaps IT.PRO-16.1.
IT.PRO-16.1 requires the integrity and authenticity of software, components and updates to be assessed before use; ISM-1792 covers the authenticity part, assessing the authenticity of operating systems, applications, IT and OT equipment and services as part of acceptance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.