Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

GOV-11 Supplier cyber security assurance

five actionsAlso in ASD Essentials for enterprise IT

Choose suppliers using a risk assessment scaled to their risk. Keep checking they meet their security commitments, and act if evidence lapses or their risk changes. Keep a register of which security work each provider does and which you keep. Set policies on data sensitivity, sovereignty and reputable software suppliers.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly independently verified or otherwise risk-assessed.

ASD, Information Security Manual (ISM), Principle GOV-11

The five actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 5

    Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.

    In plain English: Choose suppliers of software, hardware and services based on a cyber supply chain risk assessment scaled to their risk. Keep suitable assurance evidence for that choice.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  2. Action 2 of 5

    Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier’s risk changes.

    In plain English: Keep checking, with current evidence, that suppliers still meet their cyber security commitments. Act when that evidence lapses or a supplier's risk changes.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  3. Action 3 of 5

    Maintain a register of inherited and retained security responsibilities per provider, and review it as services change.

    In plain English: Keep a register showing which security work each provider does for you and which you keep. Review it as services change.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  4. Action 4 of 5

    Establish policies that meet your data sensitivity and sovereignty requirements.

    In plain English: Set policies that meet your data sensitivity and data sovereignty needs. Data sovereignty means where your data is held and whose laws apply to it.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

  5. Action 5 of 5

    Establish policies that restricts software on cloud services to reputable suppliers.

    In plain English: Set policies that allow only software from reputable suppliers on your cloud services.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.