GOV-11 Govern

Supplier cyber security assurance

Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly verified or otherwise risk-assessed.

Enterprise IT actions

IT.GOV-11.1

Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision.
- Every phaseGovernance and culture
ASD’s indicators

Not effective
- No documented or approved governance process exists for evaluating the cyber security trustworthiness of suppliers.
- No cyber security evaluation is performed before suppliers are onboarded.
- Evaluation outcomes are not documented.
- Findings from supplier evaluation outcomes are not used to inform supplier approval, contractual requirements or risk treatment decisions where concerns are identified.
Partially effective
- An evaluation process exists but is not consistently applied to all suppliers within scope.
- Evaluation is performed for some suppliers, but criteria are not documented or are inconsistently applied.
- Outcomes are documented but contractual arrangements do not reflect identified risks or required controls.
Fully effective
- A documented and approved governance process is in place and consistently applied.
- Cyber security trustworthiness evaluations are performed for all suppliers within scope prior to onboarding.
- Evaluation criteria are documented, approved and proportionate to the criticality of what the supplier delivers.
- Evaluation outcomes are documented, reflected in contractual arrangements and recorded in the organisation's risk register where residual risk remains.
Related frameworks

ISM
ISM-1452, ISM-1568, ISM-1631, ISM-1632, ISM-1787
NIST CSF 2.0
GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-07, GV.SC-06
NIST SP 800-171r3
03.17.01, 03.17.02, 03.17.03, 03.16.03
AESCSF v2
THIRD-PARTIES-2a, THIRD-PARTIES-2b, THIRD-PARTIES-2d, THIRD-PARTIES-2j
MITRE ATT&CK
T1195 Supply Chain Compromise

Rate this action in the Navigator
IT.GOV-11.2

Maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier's risk changes.
- Every phaseGovernance and culture
ASD’s indicators

Not effective
- No process exists to obtain and risk-assess current supplier assurance evidence proportionate to supplier criticality and risk.
- No documented and approved governance process exists for maintaining assurance that suppliers meet their cyber security commitments.
- No actions are taken when supplier cyber security assurance lapses or supplier risk changes.
Partially effective
- Supplier assurance evidence is obtained for some suppliers, but coverage is incomplete or the evidence is not reviewed and actioned.
- Some findings are actioned but the response process is informal or inconsistent.
- A process exists but acceptable forms and currency of assurance evidence are not defined or applied consistently.
Fully effective
- Current assurance evidence is obtained from suppliers in proportion to their criticality and risk, and is reviewed for findings that affect the organisation.
- Material concerns are addressed through contractual remediation, compensating controls or supplier substitution within defined timeframes.
- A documented and approved governance process specifies the acceptable forms, scope and currency of supplier assurance evidence.
Related frameworks

ISM
ISM-1567, ISM-1785, ISM-1882
NIST CSF 2.0
GV.SC-07, GV.SC-09
NIST SP 800-171r3
03.17.03, 03.16.03
AESCSF v2
THIRD-PARTIES-2f, THIRD-PARTIES-2g
MITRE ATT&CK
T1195 Supply Chain Compromise

Rate this action in the Navigator

Operational technology actions

Action 1

Establish and maintain a process to assess and manage supply chain risk for hardware, software and third party service providers, and to confirm that providers of services essential to OT understand the criticality of vital OT and can meet agreed levels of prioritised support.
- Every phaseGovernance and culture
Rate this action in the Navigator
Action 2

Establish and maintain a process to only use software, hardware and services from trustworthy suppliers that have demonstrated a commitment to the security of, and transparency for, their products and services
- Every phaseGovernance and culture
Rate this action in the Navigator

Cloud actions

Action 1

Select and engage suppliers of software, hardware and services on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain appropriate assurance evidence to support the decision
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 2

Maintain current, appropriately scoped assurance that suppliers continue to meet their cyber security commitments, and act when assurance lapses, excludes a service or feature in use, or the supplier's risk changes.
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 3

Maintain a register of inherited and retained security responsibilities per provider, and review it as services change
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 4

Establish policies that meet your data sensitivity and sovereignty requirements
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 5

Establish policies that restricts software on cloud services to reputable suppliers
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator

Open the Navigator

More Govern principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.