Ensure Service Provider Contracts Include Security Requirements

frameworkCIS Controls v8.1 section15. Service Provider Management csf 2.0DE.CM-06 GV.SC-02 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 ID.RA-10 topicsVendor Risk Mgmt frameworks0 10 2

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 15.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Loosely related Only shares CSF GV.SC-02: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 10 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping A.5.2 Information security roles and responsibilities Loosely related Only shares CSF GV.SC-02: related, not a mapping A.5.4 Management responsibilities Loosely related Only shares CSF GV.SC-02: related, not a mapping A.5.26 Response to information security incidents Loosely related Only shares CSF GV.SC-08: related, not a mapping Clause 5.3 Organizational roles, responsibilities and authorities Loosely related Only shares CSF GV.SC-02: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 2 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 16 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-08: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-06, GV.SC-08: related, not a mapping 12.9.2 Service providers support customer compliance requests Loosely related Only shares CSF GV.SC-05, GV.SC-07: related, not a mapping 12.10.1 Incident response plan ready to activate Loosely related Only shares CSF GV.SC-02, GV.SC-08: related, not a mapping 12.1.4 Executive responsibility for information security assigned Loosely related Only shares CSF GV.SC-02: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF GV.SC-08: related, not a mapping 12.10.5 Plan covers alerts from security monitoring Loosely related Only shares CSF GV.SC-08: related, not a mapping …and 8 more in the downloads
CMMC	RA.L2-3.11.1 IR.L2-3.6.1 IR.L2-3.6.2 CA.L2-3.12.3	Risk Assessments; Incident Handling…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +3 more loosely related (not mappings) CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-06: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06: related, not a mapping
800-53	SA-4 SA-9 SR-6	Acquisition Process; External System Services…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 9 loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-02, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-02, GV.SC-05, GV.SC-06: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-02, GV.SC-08: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF GV.SC-08: related, not a mapping SR-10 Inspection of Systems or Components Loosely related Only shares CSF GV.SC-05: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 1 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 14 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF GV.SC-08: related, not a mapping §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.SC-08: related, not a mapping §164.316(b)(2)(ii) Availability Loosely related Only shares CSF GV.SC-08: related, not a mapping …and 6 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 4 loosely related (not mappings) 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF GV.SC-02: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-05: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.