ASD ISM 1804 Include break clauses in cloud service contracts
What it says
Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishContracts must have clauses that allow termination if security requirements aren't met by service providers.
Imagine you're relying on a company to securely manage your important files in the cloud. What happens if they fail to protect your data? This control means you can end your contract if they don't meet their security promises. It's important because having this safety net helps you avoid bigger issues if things go wrong.
Free. Save your status, tasks and notes.
Why it matters
Without break clauses tied to unmet security requirements, you may be locked into a non-compliant cloud provider, extending breach exposure and increasing legal and reputational risk.
How to implement
Business managers should work with legal experts to ensure the contract with your cloud service provider includes clear terms about data security expectations.
Draft these terms with precise language that specifies the security standards required, such as data encryption and regular audits.
Procurement officers should collaborate with IT and security teams to identify potential risks associated with the service provider.
Conduct a risk assessment to understand where the provider might fall short and ensure these risks are addressed in the break clauses of the contract.
Legal advisors must review current cloud service contracts to check for existing security clauses.
They can update the contracts by adding break clauses that specify actions, like terminating the contract if the provider fails to comply with the agreed security measures.
Business owners should set up regular meetings with the cloud service provider to review compliance with security clauses.
In these meetings, go through the provider's performance reports to verify they are upholding their security commitments.
HR and training managers should provide education sessions for staff involved in managing cloud services.
Teach them about the importance of break clauses and how to monitor contracts for any security compliance issues.
Keep it running
Review cloud contracts to ensure break clauses explicitly cover failure to meet security requirements, define triggers/evidence, and specify termination or remediation timeframes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The signed cloud service contract.
Look at
The section detailing the terms and conditions regarding security measures and any break clauses for non-compliance.
Good evidence
Shows clear, signed clauses that articulate the right to terminate the contract if security promises aren't met.
- Check 2 of 5What an auditor asks for
Look at
Identified risks about using the cloud service provider and mitigation strategies outlined.
Good evidence
Includes these risks being directly addressed in the contract's break clauses.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of periodic compliance meetings.
Look at
Meeting notes or minutes that discuss compliance with the security terms.
Good evidence
Shows regular, documented meetings where security compliance is reviewed.
- Check 4 of 5What an auditor asks for
Look at
The details comparing actual security performance to agreed standards in the contract.
Good evidence
Includes consistent or exceeding results with action items if standards were not met.
- Check 5 of 5What an auditor asks for
Ask for
Training records for relevant staff.
Look at
Attendance logs and training content about understanding and managing break clauses.
Good evidence
Shows thorough training that includes examples of how to handle non-compliance.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control covers in full and more.
ISO/IEC 27001: 3 mappings
This control is broader than A.5.21.
Annex A 5.21 addresses end-to-end management of ICT supply chain security risks via defined processes and procedures. ISM-1804 aligns by requiring break clauses in cloud service contracts tied to failure to meet security requirements, strengthening supplier accountability and exit options. This is a specific contractual safeguard within the wider supplier governance and risk management expectations of Annex A 5.21.
This control partially meets A.5.19.
ISM-1804 relates to contractual break clauses for cloud service security non-compliance. ISO/IEC 27001:2022 Annex A 5.19 discusses managing information security risks across supplier relationships, including contracting and enforcement. Annex A 5.19 is broader as it pertains to comprehensive supplier risk management, beyond ISM-1804's specific focus.
This control partially meets A.5.20.
Annex A 5.20 requires organisations to agree on information security requirements with suppliers. ISM-1804 is narrower, specifying break clauses as a contractual mechanism for cloud service providers to enforce consequences when security requirements are unmet.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.