Assess Service Providers
Description
Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.
Implementation Checklist
Tool Recommendations
Third-party risk management with automated vendor assessments, continuous monitoring, and risk scoring
ServiceNow · Enterprise subscription
Third-party risk management platform with vendor assessment automation, continuous monitoring, and compliance mapping
OneTrust · Enterprise subscription
Cybersecurity ratings and third-party risk management platform with continuous monitoring and vendor assessment automation
SecurityScorecard · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Engagement with Provider Having Inadequate Security Controls
ConfidentialityThe organization entrusts sensitive data to a service provider with a weak security posture because no assessment was conducted, and the provider subsequently suffers a breach affecting enterprise data.
Provider Security Posture Degrades Over Contract Period
IntegrityA service provider that was initially compliant reduces security investments over the contract period, and the degradation goes unnoticed because no periodic reassessment is performed.
Vulnerabilities (When Safeguard Absent)
No Security Assessment of Service Providers
Without assessing service providers through SOC 2 reviews, questionnaires, or equivalent processes, the organization has no objective understanding of each provider's actual security capabilities and practices.
No Periodic Reassessment of Provider Security Posture
Absence of annual or contract-renewal reassessment means the organization relies on initial assessments that may no longer reflect the provider's current security state.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |