CIS Control 15: Service Provider Management | The State of Security

Enterprises today rely on partners and vendors to help manage their data. Some companies depend on third-party infrastructure for day-to-day operations, so understanding the regulations and protection standards that a service provider is promising to uphold is very important.

Key Takeaways from Control 15

Identify your business needs and create a set of standards that can be used to grade services providers that are being proposed. Every company is different, so one set of standards will not be the same in different sectors.

Organize and monitor all services providers that are associated with your business. Keeping an inventory of all services providers will enable you to monitor them in case they update their policies. When one is updated, you can then assess and make a decision if the service provider meets the standards that have been set in your service provider management policy.

Safeguards for Control 15

15.1 Establish and Maintain an Inventory of Service Providers

Description: Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include classification(s), and designate an enterprise contact for each service provider. Review and update the inventory annually or when significant enterprise changes that could impact this Safeguard occur.

Notes: The security function associated with this Safeguard is Identify. The objective of this control is to keep an organized inventory of services providers and to identify a point of contact with each service provider. 

15.2 Establish and Maintain a Service Provider Management Policy

Description: Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually or when significant enterprise changes that could impact this Safeguard occur.

Notes: The security function associated with this Safeguard is Identify. When developing a service provider management policy, keep in mind that not all businesses are the same. There will not be one set of standards that will apply to every sector of industry. For example, a business in the financial sector will have different standards to follow than a business in the education sector. Establish the needs of your business and then create a checklist from which you can better narrow down the frameworks and/or industry standards you intend to follow.

15.3 Classify Service Providers

Description: Classify service providers. Classification consideration may include one or more characteristics such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually or when significant enterprise changes that could impact this Safeguard occur.

Notes: The security function associated with this Safeguard is Identify. Classifying service providers will be dependent upon Safeguards 15.1 and 15.2. Once you’ve identified potential service providers that meet the established policy, classification can begin. This will give a more granular representation of the service providers.

15.4 Ensure Service Provider Contracts Include Security Requirements

Description: Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption mandates, and data disposal commitments. These security requirements must be consistent with the enterprise’s service provider management policy. Review service provider contracts annually to ensure contracts are not missing security requirements.

Notes: The security function associated with this Safeguard is Protect. Security should be implemented in the beginning stages when developing a service provider management policy. Security is important to start off with because it can become costly long term if left neglected. Ensure that the service providers being considered incorporate industry standards for security such as ISO 27001.

15.5 Assess Service Providers

Description: Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.

Notes: The security function associated with this Safeguard is Identify. Ensure that service providers are in line with the scope set forth in your service provider management policy.

15.6 Monitor Service Providers

Description: Monitor service providers consistent with the enterprise’s service provider management policy. Monitoring may include periodic reassessment of service provider compliance, monitoring service provider release notes, and dark web monitoring.

Notes: The security function associated with this Safeguard is Detect. Monitor service providers to ensure they are consistent with your service provider management policy. Review release notes on updates provided from service providers to ensure they are still in line with scope of your service provider management policy. React if they fall outside of the scope of the policy.

15.7 Securely Decommission Service Providers

Description: Securely decommission service providers. Example considerations include user and service account deactivation, termination of data flows, and secure disposal of enterprise data within service provider systems.

Notes: The security function associated with this Safeguard is Protect. Always make sure when you choose to decommission service providers that user/service accounts are deactivated to prevent unauthorized access. This also means securely disposing of enterprise data that has been stored on service provider systems.

Read more about the 18 CIS Controls here:

CIS Control 1: Inventory and Control of Enterprise Assets

CIS Control 2: Inventory and Control of Software Assets

CIS Control 3: Data Protection

CIS Control 4: Secure Configuration of Enterprise Assets and Software

CIS Control 5: Account Management

CIS Control 6: Access Control Management

CIS Control 7: Continuous Vulnerability Management

CIS Control 8: Audit Log Management

CIS Control 9: Email and Web Browser Protections

CIS Control 10: Malware Defenses

CIS Control 11: Data Recovery

CIS Control 12: Network Infrastructure Management

CIS Control 13: Network Monitoring and Defense

CIS Control 14: Security Awareness and Skill Training

CIS Control 15 Service Provider Management