Australian Information Security Manual ISM-1395: Provider and subcontractor data protection

What else in your programme already covers this

This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Guidelines for procurement and outsourcing

• ISM-0072 Documenting data security requirements in contracts
• ISM-0141 Incident reporting obligations for providers
• ISM-1073 Contracts before provider system access
• ISM-1451 Data types and ownership in contracts
• ISM-1452 Supply chain risk assessment
• ISM-1529 Cloud models for SECRET and TOP SECRET
• ISM-1567 Excluding high risk suppliers
• ISM-1568 Suppliers committed to product security