Australian Information Security Manual ISM-1073: An organisation's systems are not accessed or administered by a service provider unless a

An organisation's systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.

Other controls in Guidelines for procurement and outsourcing

ISM-0072 Security requirements associated with the confidentiality, integrity and availability of d
ISM-0141 The requirement for service providers to report cyber security incidents to a designated p
ISM-1395 Service providers, including any subcontractors, provide an appropriate level of protectio
ISM-1451 Types of data and its ownership is documented in contractual arrangements with service pro
ISM-1452 A supply chain risk assessment is performed for suppliers of operating systems, applicatio
ISM-1529 Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud servi
ISM-1567 Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
ISM-1568 Operating systems, applications, IT equipment, OT equipment and services are procured from

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls