Guidelines for procurement and outsourcing
40 controls · September 2026 edition
- ISM-0072 · Contractual security requirements with service providers
Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and regularly reviewed to ensure they remain fit for purpose.
- ISM-0141 · Contractual security requirements with service providers
The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers.
- ISM-1073 · Access to systems by service providers
An organisation’s systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.
- ISM-1395 · Contractual security requirements with service providers
Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services.
- ISM-1451 · Contractual security requirements with service providers
Types of data and its ownership is documented in contractual arrangements with service providers.
- ISM-1452 · Cyber supply chain risk management activities
A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system’s security risk profile.
- ISM-1529 · Outsourced cloud services
Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services.
- ISM-1567 · Cyber supply chain risk management activities
Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
- ISM-1568 · Cyber supply chain risk management activities
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to the security of their products and services.
- ISM-1569 · Cyber supply chain risk management activities
A shared responsibility model is created, documented and shared between suppliers and their customers to articulate the security responsibilities of each party.
- ISM-1570 · Assessment of outsourced cloud service providers
Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
- ISM-1571 · Contractual security requirements with service providers
The right to verify compliance with security requirements is documented in contractual arrangements with service providers.
- ISM-1572 · Contractual security requirements with service providers
The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes, is documented in contractual arrangements with service providers.
- ISM-1573 · Contractual security requirements with service providers
Access to all logs relating to an organisation’s data and services is documented in contractual arrangements with service providers.
- ISM-1574 · Contractual security requirements with service providers
The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers.
- ISM-1575 · Contractual security requirements with service providers
A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers.
- ISM-1576 · Access to systems by service providers
If an organisation’s systems are accessed or administered by a service provider in an unauthorised manner, it is treated as a cyber security incident and the organisation is immediately notified.
- ISM-1631 · Cyber supply chain risk management activities
Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identified.
- ISM-1632 · Cyber supply chain risk management activities
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong track record of maintaining the security of their own systems.
- ISM-1637 · Outsourced cloud services
An outsourced cloud service register is developed, implemented, maintained and regularly verified.
- ISM-1638 · Outsourced cloud services
An outsourced cloud service register contains the following for each outsourced cloud service:
- ISM-1736 · Managed services
A managed service register is developed, implemented, maintained and regularly verified.
- ISM-1737 · Managed services
A managed service register contains the following for each managed service:
- ISM-1738 · Contractual security requirements with service providers
The right to verify compliance with security requirements documented in contractual arrangements with service providers is regularly exercised.
- ISM-1785 · Supplier relationship management
A supplier relationship management policy is developed, implemented and maintained.
- ISM-1786 · Supplier relationship management
An approved supplier list is developed, implemented and maintained.
- ISM-1787 · Sourcing operating systems, applications, IT equipment, OT equipment and services
Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers.
- ISM-1788 · Sourcing operating systems, applications, IT equipment, OT equipment and services
Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equipment and services.
- ISM-1789 · Sourcing operating systems, applications, IT equipment, OT equipment and services
Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.
- ISM-1790 · Delivery of operating systems, applications, IT equipment, OT equipment and services
Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their integrity.
- ISM-1791 · Delivery of operating systems, applications, IT equipment, OT equipment and services
The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.
- ISM-1792 · Delivery of operating systems, applications, IT equipment, OT equipment and services
The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.
- ISM-1793 · Assessment of managed service providers
Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
- ISM-1794 · Contractual security requirements with service providers
A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers.
- ISM-1804 · Contractual security requirements with service providers
Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.
- ISM-1882 · Cyber supply chain risk management activities
Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to transparency for their products and services.
- ISM-1971 · Assessment of managed service providers
Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.
- ISM-1972 · Assessment of outsourced cloud service providers
Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cloud services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.
- ISM-2124 · Access to systems by service providers
Access by a service provider to an organisation’s systems is restricted to remote management tools, source network addresses and time windows explicitly approved by the organisation.
- ISM-2125 · Access to systems by service providers
All access to an organisation’s systems by a service provider is independently logged by the organisation in a manner that the service provider cannot modify or delete, and analysed in a timely manner to detect any anomalous, unexpected or unauthorised activity.
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.