ASD ISM 1882 Procurement from transparent suppliers
What it says
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to transparency for their products and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure vendors are transparent about their products and services before purchasing.
This control is about making sure you only buy tech products and services from suppliers who are upfront and honest about what they're providing. This is important because if a supplier won't disclose details, they might be hiding security risks. These hidden risks can lead to data breaches or other security issues for your business.
Free. Save your status, tasks and notes.
Why it matters
If suppliers are not transparent (e.g., no SBOMs or disclosure), insecure components may be procured, raising compromise and data loss risk.
How to implement
Procurement team should check for supplier transparency: Before purchasing, procurement should ask potential suppliers to provide clear details about their products, such as technical specifications and security features.
They can do this by preparing a detailed questionnaire for suppliers to complete.
Manager should verify supplier credentials: The manager should ensure that suppliers have a solid reputation for transparency by checking reviews and ratings from other businesses.
They can do this by visiting industry-specific forums and reading testimonials or case studies.
IT team should evaluate supplier's security declarations: The IT team should review any security documentation suppliers provide, such as certifications or security audits.
They can do this by comparing the documents against known standards and guidelines from the Australian Cyber Security Centre (ACSC).
Procurement should require contracts with transparency clauses: Ensure contracts include provisions for ongoing transparency, such as immediate disclosure of product vulnerabilities.
They can achieve this by working closely with legal advisors to draft appropriate clauses.
Management should establish a transparent supplier list: Create and maintain a list of approved suppliers known for their transparency.
They can do this by regularly updating the list based on feedback from users and audits of supplier performance.
Keep it running
Assess supplier transparency during procurement (SBOMs, disclosure policy, provenance) and re-review periodically; update approved supplier lists as risks change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Supplier questionnaires: Request copies of the questionnaires sent to suppliers and their responses.
Look at
How transparently the suppliers answered key questions about product specs and security.
Good evidence
Will show full and clear responses detailing product security measures.
- Check 2 of 5What an auditor asks for
Ask for
Supplier verification records: Ask to see notes or reports on the background checks conducted on suppliers.
Look at
Evidence that reviews and feedback were collected from multiple credible sources.
Good evidence
Involves documented records of supplier reputations from several trusted platforms.
- Check 3 of 5What an auditor asks for
Ask for
Security documentation from suppliers: Request any security certifications or audit reports suppliers have provided.
Look at
How current and comprehensive these documents are.
Good evidence
Includes up-to-date certifications aligned with ACSC standards.
- Check 4 of 5What an auditor asks for
Ask for
Contract examples: Request copies of contracts with the transparency clauses included.
Look at
Clauses that require suppliers to disclose vulnerabilities or changes in product security promptly.
Good evidence
Shows specific clauses that clearly state these obligations.
- Check 5 of 5What an auditor asks for
Ask for
The approved supplier list: Request to see the current list of approved, transparent suppliers.
Look at
The criteria for suppliers to be listed and how regularly the list is reviewed.
Good evidence
Is a well-maintained list that shows dates of last review and criteria met by each supplier.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.19.
ISM-1882 requires organisations to procure operating systems, applications, IT/OT equipment and services only from suppliers that have demonstrated a commitment to transparency about their products and services. Annex A 5.19 requires defined processes to manage information security risks in supplier relationships, within which "transparent supplier selection" is a specific risk treatment and due diligence criterion. Annex A 5.19 is broader because it covers the full supplier relationship risk lifecycle (selection, onboarding, management, offboarding), whereas ISM-1882 focuses specifically on transparency at procurement time.
This control partially meets A.5.21.
ISM-1882 requires procurement from suppliers that demonstrate transparency for the products and services being acquired. Annex A 5.21 addresses managing information security risks across the ICT supply chain, where supplier transparency (e.g., visibility of components, vulnerabilities, development practices) is one mechanism to reduce supply chain risk. Annex A 5.21 is broader because it covers multi-tier supply chain governance and ongoing controls, not just the procurement decision emphasised by ISM-1882.
This control partially overlaps A.5.20.
ISM-1882 requires organisations to select suppliers that have demonstrated transparency about their products and services before procurement. Annex A 5.20 focuses on integrating relevant information security requirements into supplier agreements, which can include contractual obligations for transparency (e.g., disclosure of vulnerabilities, SBOMs, audit rights, incident notification). They overlap where transparency expectations are formalised contractually, but ISM-1882 also concerns supplier selection and evidence of transparency even prior to contract execution.
This control partially overlaps A.5.22.
ISM-1882 requires procurement from suppliers that demonstrate transparency for their products and services. Annex A 5.22 requires ongoing monitoring, review, and management of supplier information security practices and service delivery, which can include verifying that suppliers continue to be transparent (e.g., timely disclosure of vulnerabilities and changes). They overlap on the expectation of supplier behaviour around transparency, but Annex A 5.22 is focused on post-procurement governance while ISM-1882 is primarily a procurement gate.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.10.3.
Annex A 10.3 requires supplier management so external services/products/materials used in AI support responsible AI development and use. ISM-1882 overlaps by requiring procurement from suppliers committed to transparency, which directly enables responsible AI assurance such as visibility of training data sources, model limitations, evaluation results and update practices. ISM-1882 focuses on transparency as a procurement criterion, while Annex A 10.3 is broader across other responsible AI requirements (e.g., accountability, human oversight, safety and misuse prevention).
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.GOV-11.2.
IT.GOV-11.2 requires current assurance that suppliers still meet their cyber security commitments, with action if it lapses or their risk changes; ISM-1882 supports that assurance by procuring from suppliers with a demonstrated commitment to transparency for their products and services.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.