ASD ISM 1794 Notify significant changes to service provider agreements
What it says
A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishService providers must inform clients at least one month in advance of major changes to their contracts.
This control means that your service providers, like those who manage your IT or cloud services, need to tell you at least a month before they make big changes to your contract. This matters because if something important changes without you knowing, you might get unpleasant surprises that could disrupt your business or increase your costs unexpectedly.
Free. Save your status, tasks and notes.
Why it matters
Without at least one month's notice of significant subcontractor/arrangement changes, agencies may face service disruption, compliance gaps and unplanned costs.
How to implement
Procurement teams should ensure contracts include a clause about advance notice for contract changes.
When negotiating or reviewing contracts with service providers, include a requirement that any significant changes must be communicated at least one month in advance, ensuring transparency and time to make necessary adjustments.
Managers should maintain a calendar with contract renewal and review dates.
Use this calendar to schedule reminders a month before potential contract changes, so the team can review potential impacts and prepare effectively.
Service providers must establish a formal process to notify clients of upcoming changes.
Design a simple communication plan that uses email or letter to inform clients at least a month beforehand, highlighting specific changes and their implications.
Legal teams should review and approve any contract updates or amendments from service providers.
Prior to accepting changes, check the contract modifications align with your organisation's needs and verify the notification period requirement is met.
IT teams should assess how proposed changes might impact services.
Whenever a notice of change is received, evaluate the potential effects on operational systems and collaboratively plan any required adaptations with relevant stakeholders.
Keep it running
Include contract clauses requiring service providers to give a minimum one‑month notice of significant changes to their own provider arrangements, and track notifications.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the service provider contract. Review the section detailing change notification terms, focusing on whether a one-month advance notice clause is included.
Good evidence
Will show a clear clause specifying the notification period and agreement conditions.
- Check 2 of 5What an auditor asks for
Look at
The dates of the notifications and the specifics of the changes communicated.
Good evidence
Indicates that all significant changes were communicated at least one month in advance.
- Check 3 of 5What an auditor asks for
Ask for
A calendar or log of contract review dates. Investigate if there are regular reminders set for contract renewals and updates.
Good evidence
Shows a systematic and timely approach to review processes, ensuring preparedness for upcoming changes.
- Check 4 of 5What an auditor asks for
Look at
The steps outlined for evaluating and approving changes.
Good evidence
Outlines a structured process that considers contractual requirements and business impacts.
- Check 5 of 5What an auditor asks for
Ask for
To see communication records related to service provider changes.
Look at
The communication method and details shared with stakeholders.
Good evidence
Includes clear, timely communication with relevant parties about upcoming changes and their implications.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-1794 requires contractual terms that compel service providers to give at least one month's notice before significant changes to their own service provider arrangements. ISO/IEC 27001:2022 Annex A 5.19 relates by requiring defined processes to manage information security risks in supplier relationships, which commonly includes managing and being notified of supplier changes that could affect risk. ISM-1794 is a specific contractual notification requirement, while Annex A 5.19 is broader and covers the overall supplier risk management lifecycle beyond notice periods.
This control partially meets A.5.20.
ISM-1794 requires organisations to document a minimum one-month notification period for significant supplier-side arrangement changes within contracts. ISO/IEC 27001:2022 Annex A 5.20 relates because it requires integrating relevant information security requirements into supplier agreements, which is the mechanism used to mandate advance change notification. ISM-1794 is one particular clause requirement (time-bound change notification), whereas Annex A 5.20 covers establishing and agreeing a wider set of security clauses appropriate to the supplier relationship.
This control partially meets A.5.22.
ISM-1794 requires suppliers to provide at least one month's notice of significant changes to their own downstream service provider arrangements, as documented in the contract. ISO/IEC 27001:2022 Annex A 5.22 relates by requiring organisations to monitor, review, evaluate and manage change in supplier information security practices and service delivery, which depends on timely awareness of supplier changes. ISM-1794 focuses specifically on advance notification via contractual commitment, while Annex A 5.22 is broader and includes ongoing performance/security monitoring and change management activities.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.2.
Annex A 10.2 requires the organisation to allocate and document responsibilities across the AI system life cycle between the organisation and external parties. ISM-1794 relates by requiring contractual allocation of responsibility to the service provider to provide timely notification (minimum one month) of significant downstream subcontractor/arrangement changes. The overlap is in clarifying who must do what at supplier interfaces, but ISM-1794 is narrower and focused on a specific change-notification obligation rather than end-to-end AI life-cycle responsibility allocation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.