PRO-16 Cyber supply chain security
2 actions under this Protect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response.
Quoted as published. Everything else on this page is written by Control Stack.
The two actions
- IT.PRO-16.1Verify Integrity, Authenticity and Provenance of Software, Components and Updates Before Use
Confirms software, components and updates are genuine and unchanged before use, and checks where they came from when suppliers give proof.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-16.2Monitor Vendor Advisories and Threat Intelligence to Act on Supply Chain Exposure
Watches vendor warnings and threat reports for suppliers, products or components exposed to compromise, and acts as fast as the risk requires.
Domains:Boundary servicesIdentity servicesCritical processes and servicesPrivileged environments
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.