Topic

Contractual security requirements with service providers

Applicable to

all

History

Priority

should

Dec 2022

Types of data and its ownership is documented in contractual arrangements with service providers.

Language from existing controls relating to ‘contractual arrangements’ was amended to ‘contractual arrangements with service providers’.

Jul 2020

Types of information and its ownership is documented in contractual arrangements.

Security control 1451 was amended to focus on the types of information provided to service providersand that ownership of such information is documented in contractual arrangements.

Jun 2020

When entering into a contractual arrangement for outsourced information technology or cloud services, contractual ownership over an organisation’s data is explicitly retained.

2015

When entering into a contract or other agreement for information technology services,agencies should explicitly retain contractual ownership over their data.