ASD Essentials for Enterprise IT GOV-11: Supplier cyber security assurance: risk-assess suppliers proportionately, retain evidence and keep assurance current

What does GOV-11 require?

Suppliers of software, hardware and services are chosen and contracted only after a supply chain risk assessment scaled to the risk each one brings, the evidence behind that decision is kept, the organisation keeps checking that each supplier still honours its security commitments, and it acts when that assurance expires or the supplier's risk profile shifts.