Guidelines for procurement and outsourcing

Assess each supplier of operating systems, applications, IT and OT equipment, and services to understand how they affect your system's security risk.

Suppliers considered high risk are not chosen to ensure the security of the supply chain.

Buy IT and OT products only from suppliers who show they care about product security.

Create, write down and share a shared responsibility model so suppliers and customers each know which security tasks they own.

Ensure all suppliers linked to IT and OT systems are identified for security management.

Buy technology from suppliers known for keeping their systems secure.

Ensure a policy is in place for managing relationships with suppliers in a consistent manner.

Ensure a list of approved suppliers is created, used, and kept updated.

Ensure systems and equipment are bought from pre-approved suppliers to mitigate risks.

Ensure multiple suppliers are considered for sourcing essential IT systems and services to reduce supply chain risks.

Source and keep sufficient spares of critical IT and OT equipment in reserve so failed items can be quickly replaced.

Deliveries of IT and OT systems should be made securely to prevent tampering or integrity loss.

Check the integrity of IT and OT products before accepting them to ensure they're safe and reliable.

Ensure that software and equipment are genuine before accepting them.

Ensure vendors are transparent about their products and services before purchasing.

Include security needs in contracts with service providers and review them to ensure they meet current standards.

Service providers must report cyber incidents quickly to a specified contact as part of their contract.

Service providers need a contract before accessing or managing your systems.

Service providers must protect any entrusted data adequately.

Ensure contracts with service providers clearly state who owns the data.

For SECRET or TOP SECRET services, only community or private clouds should be used to ensure security.

Cloud service providers must undergo an IRAP review at least every 24 months.

Contracts with service providers must include clauses that allow security compliance checks.

Ensure service contracts specify data regions and notify configuration changes ahead of time.

Ensure contracts specify how organisations can access logs about their data from service providers.

Ensure service contracts cover data portability for backups, migration, and decommissioning.

Service contracts require a one-month notice before a provider can stop services.

Any unauthorised access to, or administration of, your systems by a service provider is handled as a cyber security incident, and the provider tells you straight away.

Keep an up-to-date register of cloud services used, and regularly check it.

Keep one register that records, for every outsourced cloud service, who provides it, why it is used, what data it holds, when it is next assessed, its contract, and who to call.

Keep and regularly check a log of managed services.

Your managed service register must hold eight specific details per service, from provider and purpose through to assessment due dates, contracts and 24/7 provider contacts.

Regularly ensure service providers are following the security agreements in their contracts.

Managed service providers must be assessed for security compliance every 24 months.

Service providers must inform clients at least one month in advance of major changes to their contracts.

Contracts must have clauses that allow termination if security requirements aren't met by service providers.

Providers running TOP SECRET (including SCI) managed services must be assessed by ASD assessors, or their delegates, against a current ISM release at least every two years.

Outsourced TOP SECRET cloud providers and services (including SCI services) get an ASD-led ISM assessment at least every two years, against the current ISM at the time it starts.

Service providers may only reach your systems through the remote management tools, source network addresses and time windows your organisation has explicitly approved in advance.

Keep your own tamper-proof record of everything a service provider does in your systems, and review it promptly to catch anything odd, unexpected or unauthorised.