Procurement and outsourcing

search account_circle

policyASD ISM

Guidelines for procurement and outsourcing

38 controls in this part of theAustralian Government Information Security Manual. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Cyber supply chain risk management

Avoid High-Risk Suppliers in Cyber Supply Chain

Suppliers considered high risk are not chosen to ensure the security of the supply chain.

Ensure Security Commitment from Suppliers

Buy IT and OT products only from suppliers who show they care about product security.

Identify Suppliers in Cyber Supply Chain

Ensure all suppliers linked to IT and OT systems are identified for security management.

Ensure Secure Procurement from Reliable Suppliers

Buy technology from suppliers known for keeping their systems secure.

Develop and Maintain Supplier Management Policy

Ensure a policy is in place for managing relationships with suppliers in a consistent manner.

Maintain an Approved Supplier List

Ensure a list of approved suppliers is created, used, and kept updated.

Ensure Suppliers are Approved for IT and OT Sourcing

Ensure systems and equipment are bought from pre-approved suppliers to mitigate risks.

Identify Multiple Suppliers for Critical IT Sourcing

Ensure multiple suppliers are considered for sourcing essential IT systems and services to reduce su

Verify Authenticity for Delivery Acceptance in Supply Chain

Ensure all software, hardware, and services are genuine before accepting them for use.

Ensure Integrity in IT and OT Deliveries

Deliveries of IT and OT systems should be made securely to prevent tampering or integrity loss.

Assess Integrity of Delivered IT and OT Products

Check the integrity of IT and OT products before accepting them to ensure they're safe and reliable.

Assess Authenticity of IT and OT Deliveries

Ensure that software and equipment are genuine before accepting them.

Procurement from Transparent Suppliers

Ensure vendors are transparent about their products and services before purchasing.

Cyber Supply Chain Risk Management

Perform Supply Chain Risk Assessments for System Suppliers

Assess each supplier of operating systems, applications, IT and OT equipment, and services to unders

Document and Share a Supplier Customer Shared Responsibility Model

Create, write down and share a shared responsibility model so suppliers and customers each know whic

Managed services and cloud services

Report Cyber Incidents Promptly to Designated Contacts

Service providers must report cyber incidents quickly to a specified contact as part of their contra

Ensure Provider Contracts for System Access

Service providers need a contract before accessing or managing your systems.

Ensuring Data Protection by Service Providers

Service providers must protect any entrusted data adequately.

Document Data Ownership in Service Contracts

Ensure contracts with service providers clearly state who owns the data.

Limit Cloud Services to Community or Private for SECRETS

For SECRET or TOP SECRET services, only community or private clouds should be used to ensure securit

Regular IRAP Assessment of Cloud Service Providers

Cloud service providers must undergo an IRAP review at least every 24 months.

Verify Security Compliance in Service Contracts

Contracts with service providers must include clauses that allow security compliance checks.

Document Service Provider Data Handling and Change Notifications

Ensure service contracts specify data regions and notify configuration changes ahead of time.

Log Access Documentation with Service Providers

Ensure contracts specify how organisations can access logs about their data from service providers.

One-Month Notice for Service Termination

Service contracts require a one-month notice before a provider can stop services.

Notify Organisation of Unauthorised System Access

Service providers must alert organisations if they access systems without permission.

Maintain a Comprehensive Outsourced Cloud Service Register

Keep a detailed list of cloud services used, including provider details, service purpose, and securi

Maintain a Comprehensive Managed Service Register

Keep a detailed register of all managed services, including providers, purpose, data sensitivity, as

Regular Assessment of Managed Service Providers

Managed service providers must be assessed for security compliance every 24 months.

Notify Significant Changes to Service Provider Agreements

Service providers must inform clients at least one month in advance of major changes to their contra

Include Break Clauses in Cloud Service Contracts

Contracts must have clauses that allow termination if security requirements aren't met by service pr

Security Assessments for TOP SECRET Managed Services

TOP SECRET managed services must undergo security checks by ASD assessors every two years.

Security Assessments for Top Secret Cloud Services

Cloud providers' secret services need security checks every two years by authorised assessors.

Managed Services and Cloud Services

Document Security Requirements in Contractual Arrangements

Include security needs in contracts with service providers and review them to ensure they meet curre

Data Portability in Service Contracts

Ensure service contracts cover data portability for backups, migration, and decommissioning.

Maintain an Outsourced Cloud Service Register

Keep an up-to-date register of cloud services used, and regularly check it.

Maintain and Verify Managed Service Register

Keep and regularly check a log of managed services.

Verify Compliance with Security Requirements

Regularly ensure service providers are following the security agreements in their contracts.

Back to the full Information Security Manual (ISM) control list, or browse the complete control library.