Australian Information Security Manual ISM-1971: Managed service providers and their TOP SECRET managed services, including sensitive compa

Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed services, undergo a security assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security assessment (or a subsequent release), at least every 24 months.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for procurement and outsourcing

ISM-0072 Security requirements associated with the confidentiality, integrity and availability of d
ISM-0141 The requirement for service providers to report cyber security incidents to a designated p
ISM-1073 An organisation's systems are not accessed or administered by a service provider unless a
ISM-1395 Service providers, including any subcontractors, provide an appropriate level of protectio
ISM-1451 Types of data and its ownership is documented in contractual arrangements with service pro
ISM-1452 A supply chain risk assessment is performed for suppliers of operating systems, applicatio
ISM-1529 Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud servi
ISM-1567 Suppliers identified as high risk by a cyber supply chain risk assessment are not used.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls