Safeguard 15.1 Service provider inventory
Keeping an inventory of all known service providers with their classification and an enterprise contact for each; the only IG1 safeguard in Control 15 and the starting point for the rest.
Control 15 Service provider management
CIS Control 15 covers evaluating service providers that hold sensitive data or run critical IT platforms or processes: provider inventory, policy, classification, contract security requirements, assessment, monitoring and secure decommissioning.
Safeguard 15.2 Service provider management policy
The policy that governs how service providers are classified, inventoried, assessed, monitored and decommissioned; the governing document behind safeguards 15.3 to 15.7.
Safeguard 15.3 Classify service providers
Classifying service providers by characteristics such as data sensitivity, data volume, availability needs, regulations and risk, so assessment and monitoring effort can follow the classification.
Safeguard 15.4 Security requirements in provider contracts
Writing security requirements into service provider contracts, such as minimum security program requirements, incident and breach notification, encryption and data disposal, with an annual contract review.
Safeguard 15.5 Assess service providers
Assessing service providers according to the policy and their classification, using reports such as SOC 2 or a PCI Attestation of Compliance or questionnaires, with reassessment at least annually; an IG3 safeguard.
Safeguard 15.6 Monitor service providers
Monitoring service providers on an ongoing basis according to the policy, for example through periodic compliance reassessment, release note monitoring and dark web monitoring; distinct from point-in-time assessment in 15.5.
Safeguard 15.7 Decommission service providers securely
Ending a service provider relationship securely: deactivating user and service accounts, terminating data flows and securely disposing of enterprise data held by the provider.
