ASD ISM 1793 Regular assessment of managed service providers
What it says
Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishManaged service providers must be assessed for security compliance every 24 months.
Managed service providers should have their security measures checked at least every two years to ensure they protect your data properly. If this isn't done, your confidential information might be at risk, leading to things like data breaches or operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without a 24‑monthly IRAP assessment against the latest ISM, MSP services may drift from ISM requirements, increasing risk of data compromise.
How to implement
Procurement should update contracts with service providers: Include a section that requires the provider to undergo these regular IRAP assessments.
Ensure all parties understand this is a non-negotiable part of the contract terms.
IT team should collaborate with service providers: Work closely with them to understand current security measures and prepare for the assessment.
This includes setting up a timeline and ensuring all necessary documents and access to systems are ready for the assessor.
Management should monitor the assessment process: Keep an eye on the assessment progress and ensure it is completed on schedule.
Follow up on any issues identified during the assessment to ensure they are addressed promptly.
HR should brief staff on the importance of regular assessments: Host information sessions or distribute materials explaining why these security checks are crucial.
This helps build a culture of security awareness within the team.
Keep it running
Book IRAP assessments for each MSP-managed service at least every 24 months and require assessors to use the latest ISM release available before assessment start.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The IRAP assessment report: Request the most recent document from your service provider showing the results of their security check.
Look at
The assessment date and any identified issues.
Good evidence
Includes a recent date, issues identified, and a plan for addressing them.
- Check 2 of 5What an auditor asks for
Ask for
The service contract: Request the contract that includes a clause mandating regular IRAP assessments.
Look at
The specific terms related to assessments.
Good evidence
Includes clear assessment terms and signed acceptance by both parties.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of issues being addressed: If past assessments found problems, request documentation showing how these were fixed.
Look at
Completion dates and follow-up checks.
Good evidence
Shows resolved issues with recent verification checks.
- Check 4 of 5What an auditor asks for
Ask for
Internal meeting notes: Request documentation of meetings between your team and the service provider preparing for the assessment.
Look at
Clear action items and timelines.
Good evidence
Includes scheduled preparation steps with responsible persons noted.
- Check 5 of 5What an auditor asks for
Ask for
Staff training materials: Request any materials used to educate staff on the importance of these assessments.
Look at
Clear explanations and evidence of training sessions being held.
Good evidence
Includes timely distribution and clear, comprehensible content.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
ISM-1793 requires managed service providers (and their managed services up to SECRET) to undergo an IRAP assessment against the latest ISM at least every 24 months. Annex A 5.19 requires organisations to define and implement processes to manage information security risks arising from supplier products and services, which is strengthened by obtaining independent assurance (e.g. IRAP) over a provider's control environment. ISM-1793 is more specific (Australian Government IRAP/ISM cadence and classification scope), while Annex A 5.19 is broader supplier-risk governance without prescribing IRAP or a reassessment interval.
This control partially meets A.5.22.
ISM-1793 mandates periodic (24‑monthly) IRAP assessments of managed service providers against the ISM to provide assurance of their security posture. Annex A 5.22 requires organisations to regularly monitor, review, and evaluate supplier security practices and service delivery, and IRAP assessment results are a concrete mechanism to evidence and inform that ongoing monitoring and review. Annex A 5.22 can be more frequent and operational in nature (service performance/security practice changes), whereas ISM-1793 is a formal independent assessment requirement on a defined cycle.
This control partially meets A.5.35.
ISM-1793 requires an independent IRAP assessment of managed service providers and their services at least every 24 months, using the latest ISM release available prior to assessment. Annex A 5.35 requires independent review of the organisation's information security approach and implementation at planned intervals or upon significant change, which is a broader assurance requirement. ISM-1793 is a specific instantiation of independent review limited to MSPs/managed services and tied to IRAP and ISM versioning/cadence.
This control supports A.5.20.
ISM-1793 requires periodic IRAP assessments of managed service providers against the ISM to maintain assurance over their security compliance. Annex A 5.20 requires agreeing relevant information security requirements with each supplier in contractual arrangements, and IRAP/ISM expectations are commonly flowed down as contractual obligations and acceptance criteria. ISM-1793 focuses on assurance via independent assessment, whereas Annex A 5.20 focuses on establishing the contractual requirements that can then be assessed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.