Establish and Maintain an Inventory of Service Providers

frameworkCIS Controls v8.1 section15. Service Provider Management csf 2.0GV.SC-04 ID.AM-04 topicsCloud Security, Vendor Risk Mgmt frameworks7 5 0

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 15.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security
ISO 27001	A.5.19 A.5.20 A.5.22 A.5.23	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security 3 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 3 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04: related, not a mapping
CMMC	AC.L2-3.1.20	External Connections	Crosswalk	Same topic: Cloud Security 2 loosely related (not mappings) AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-04: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-04: related, not a mapping
800-53	AC-20 SA-4 SA-9 SR-6	Use of External Systems; Acquisition Process…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 2 loosely related (not mappings) RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF ID.AM-04: related, not a mapping
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 5 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security 1 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 3 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 1 loosely related (not mappings) CE 3 Security Update Management Loosely related Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.