15.3
IG2 IG3

Classify Service Providers

Asset Type: N/A
Security Function: Identify

Description

Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually, or when significant enterprise changes occur that could impact this Safeguard.

Implementation Checklist

1
Document current state and create baseline inventory
2
Define data fields and attributes to track
3
Assign ownership and responsibilities
4
Establish review cadence and update procedures
5
Inventory all third-party service providers
6
Classify third parties by risk level
7
Conduct security assessments of critical vendors
8
Include security requirements in contracts

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Disproportionate Trust Granted to High-Risk Service Provider

Confidentiality

A service provider processing large volumes of sensitive regulated data is treated with the same minimal oversight as a low-risk office supply vendor because no classification system distinguishes provider risk levels.

Regulatory Non-Compliance from Unclassified Provider Handling Regulated Data

Integrity

An organization fails a regulatory audit because it cannot demonstrate risk-appropriate oversight of service providers handling protected health or financial data, as no classification scheme exists.

Vulnerabilities (When Safeguard Absent)

No Risk-Based Classification of Service Providers

Without classifying providers by data sensitivity, volume, availability requirements, and regulatory exposure, the organization applies uniform and often insufficient controls regardless of actual risk.

Inability to Prioritize Vendor Risk Management Efforts

Absence of classification prevents the organization from focusing security oversight resources on the highest-risk service providers, resulting in inadequate attention to critical vendor relationships.

Evidence Requirements

Type Evidence Item Collection Frequency
Document Current inventory or catalog documentation Maintained continuously, reviewed quarterly
Document Process/procedure documentation for identification activities Reviewed annually
Record Third-party risk assessment reports and scorecards Annually per vendor
Document Vendor contracts with security requirements Per contract cycle
Document Governing policy document (current, approved, communicated) Reviewed annually