15.2
IG2 IG3

Establish and Maintain a Service Provider Management Policy

Asset Type: N/A
Security Function: Identify

Description

Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes occur that could impact this Safeguard.

Implementation Checklist

1
Document current state and create baseline inventory
2
Define data fields and attributes to track
3
Assign ownership and responsibilities
4
Establish review cadence and update procedures
5
Select and deploy inventory management tool
6
Populate initial inventory with all known assets
7
Establish process for adding/removing inventory entries
8
Draft policy/procedure document
9
Obtain stakeholder review and approval
10
Communicate to affected personnel
11
Schedule periodic review and updates
12
Inventory all third-party service providers
13
Classify third parties by risk level
14
Conduct security assessments of critical vendors
15
Include security requirements in contracts

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Inconsistent Vendor Security Standards Across Departments

Confidentiality

Different business units apply varying and often inadequate security requirements to service providers because no unified management policy defines standards for vendor assessment, monitoring, and decommissioning.

High-Risk Provider Onboarded Without Security Evaluation

Confidentiality

A service provider handling sensitive regulated data is engaged without any security assessment because no policy exists that mandates evaluation criteria before onboarding vendors.

Vulnerabilities (When Safeguard Absent)

No Formal Service Provider Management Policy

Without a service provider management policy, there are no standardized requirements for classifying, assessing, monitoring, or decommissioning vendors, leading to inconsistent and often inadequate third-party risk management.

No Defined Lifecycle for Service Provider Relationships

Absence of a policy addressing the full vendor lifecycle means providers are onboarded without security requirements and remain active without periodic reassessment or proper offboarding.

Evidence Requirements

Type Evidence Item Collection Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Technical Asset/software inventory export with required fields populated Exported quarterly for review
Record Inventory review meeting minutes or sign-off Per review cycle
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually