CIS Controls v8 CIS-15.3: Classify Service Providers

What else in your programme already covers this

This control maps to 52 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-GV.SC-04 Suppliers are known and prioritized by criticality
NIST-CSF-GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition

FedRAMP High · 5 controls

AC-20(1) Limits on Authorized Use
RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1))
SR-2 Supply Chain Risk Management Plan (SR-2)
SR-6 Supplier Assessments and Reviews (SR-6)

FedRAMP Moderate · 5 controls

AC-20(1) Limits on Authorized Use
RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1))
SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1))
SR-2 Supply Chain Risk Management Plan (SR-2)
SR-6 Supplier Assessments and Reviews (SR-6)

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-PL-2 PL-2 System Security and Privacy Plans
NIST800-RA-3 RA-3 Risk Assessment
NIST800-SR-6 SR-6 Supplier Assessments and Reviews

PCI DSS 4.0 · 4 controls

12.5.2.1 12.5.2.1 Six-monthly scope confirmation for service providers
12.8.1 12.8.1 List of third-party service providers
12.8.3 12.8.3 Due diligence before engaging TPSPs
12.8.4 12.8.4 Annual monitoring of TPSP compliance status

SOC 2 · 4 controls

SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties

ISO 22301:2019 · 3 controls

4.2.2 Legal and regulatory requirements
6.1.2 Addressing risks and opportunities
8.2.3 Risk assessment

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-39 Register of Material Service Providers
CPS230-40 Mandatory Minimum Classification of Material Service Providers

APRA CPS 234 · 2 controls

CPS234-16 Assessment of Related Party and Third Party Capability
CPS234-20 Information Asset Classification

Australian Information Security Manual · 2 controls

ISM-1452 Supply chain risk assessment
ISM-1638 Cloud service register contents

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-STA-07 Supply Chain Inventory
CCM-STA-08 Supply Chain Risk Management

DORA · 2 controls

DORA-Art.29 Preliminary assessment of ICT concentration risk at entity level
DORA-Art.31 Designation of critical ICT third-party service providers

ISO 27701:2019 · 2 controls

6.12.1 Information security in supplier relationships
6.12.2 Supplier service delivery management

C5 (Germany) · 1 control

C5-SSO-02 Risk assessment of service providers and suppliers

HIPAA Security Rule · 1 control

164.308(b)(2) Subcontractor Arrangements

ISO 27001:2022 · 1 control

5.19 Information security in supplier relationships

ISO 27002:2022 · 1 control

5.19 Information security in supplier relationships

NIS2 Directive · 1 control

Art.21.3 Take account of supplier-specific vulnerabilities and of Union coordinated supply chain risk assessments

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-9 Criticality Analysis

NIST SP 800-171 Rev 3 · 1 control

03.17.01 Supply Chain Risk Management Plan

NIST SP 800-172 · 1 control

3.11.6e Supply Chain Risk Assessment, Response, and Monitoring

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-15.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free