Skip to content
OT principles
ASD Essentials

Essentials for OT

GOV-11 Supplier cyber security assurance

two actionsAlso in ASD Essentials for enterprise IT

Keep processes to assess and manage the risk from your hardware, software and service suppliers. Use only trustworthy suppliers that have shown commitment to security and openness. Confirm providers essential to OT know how critical vital OT is and can give agreed priority support.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly independently verified or otherwise risk-assessed.

ASD, Information Security Manual (ISM), Principle GOV-11

The two actions

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 2

    Establish and maintain a process to assess and manage supply chain risk for hardware, software and third party service providers, and to confirm that providers of services essential to OT understand the criticality of vital OT and can meet agreed levels of prioritised support.

    In plain English: Set up and keep a process to assess and manage supply chain risk for hardware, software and service providers. Confirm essential OT providers know vital OT's criticality and can give agreed priority support.

    Domains
    Governance and culture

  2. Action 2 of 2

    Establish and maintain a process to only use software, hardware and services from trustworthy suppliers that have demonstrated a commitment to the security of, and transparency for, their products and services

    In plain English: Set up and keep a process to use only trustworthy software, hardware and service suppliers. They must have shown commitment to security and openness for what they supply.

    Domains
    Governance and culture

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.