Australian Managed Network Services Provider Assessment
Subject: Australian Managed Network Services Provider (Anonymised)
Summary
Medium-risk supplier with bounded offshore dependencies. Approval can proceed under defined controls with domestic oversight maintained.
Assessment Outcome
Risk level: Medium
Risk score: 46/100
Confidence: 82
Key Risks
External software dependency in a Five Eyes partner jurisdiction
Controlled offshore support escalation pathway
Exposure to government communications infrastructure
Need for domestic oversight continuity
Decision: Approve with Conditions
Required Controls
Offshore escalation is disabled by default.
Explicit approval is required for any offshore support activation.
Domestic oversight is retained for all privileged actions.
Software updates for the external dependency are reviewed through an Australian-controlled verification path.
No standing offshore privileged access.
No expansion of support scope without reassessment.
No use in higher-classified environments without further review.
Mandatory Mitigations
Require immutable logging of privileged and support actions.
Insert contractual notice requirements for dependency or subcontractor changes.
Require periodic review of software dependency and escalation pathway controls.
Enforcement Requirements
Require notice of any subcontractor, support-path, or ownership change within 5 business days.
Bind the supplier to maintain Australian control over privileged governance and approval workflows.
Keep offshore escalation disabled by default in production environments.
Require logged approval workflow before any offshore escalation activation.
Retain immutable logging for all privileged, support, and escalation actions.
Route updates for the external dependency through an Australian-controlled verification path.
Restrict deployment to OFFICIAL environments unless reassessed.
Prohibit scope expansion or persistent offshore support enablement without reassessment.
Preserve support records, approval records, and assessment artifacts for audit.
Retain evidence of dependency reviews and escalation-control testing.
Monitoring
Review due: 17 April 2027.
Change in subcontractor or software dependency
Change in support escalation pathway
New foreign legal exposure affecting a supporting vendor
Change in classification or operational use
Final Procurement Position
Approve with Conditions under current controls. Reassess before any expansion of offshore support, change in dependency profile, or use in higher-classified environments.