GOV-11 Supplier cyber security assurance
2 actions under this Govern principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly verified or otherwise risk-assessed.
Quoted as published. Everything else on this page is written by Control Stack.
- Function
- Govern
- Domains
The two actions
- IT.GOV-11.1Base Supplier Selection on Proportionate Cyber Supply Chain Risk Assessments
Checks each supplier's cyber security risk before taking them on, looks harder at riskier suppliers, and keeps evidence supporting the decision.
Domains:Governance and culture - IT.GOV-11.2Maintain Current Supplier Assurance and Act on Lapses or Risk Changes
Keeps up-to-date proof that suppliers still meet their security promises, and acts when that proof lapses or a supplier's risk changes.
Domains:Governance and culture
Back to the full Essentials for enterprise IT action list, or browse the complete control library.