Australian Information Security Manual ISM-0072: Documenting data security requirements in contracts

Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and reviewed on a regular and ongoing basis to ensure they remain fit for purpose.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

What else in your programme already covers this

This control maps to 6 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship

New Zealand Information Security Manual (NZISM) · 2 controls

12.7.16.C.01 12.7.16.C.01 Contractual safeguarding obligations for all contractors
4.4.8.C.02 4.4.8.C.02 Document security expectations for third parties

CIS Controls v8 · 1 control

CIS-15.4 Ensure Service Provider Contracts Include Security Requirements

ISO 27002:2022 · 1 control

5.20 Addressing information security within supplier agreements

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.