Control: ism-1073; Revision: 5; Updated: Jun-21; Applicability: ALL; Essential Eight: N/A ​

An organisation’s systems and data are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.