Monitoring, review and change management of supplier services

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0DE.CM-06 GV.SC-01 GV.SC-04 GV.SC-07 GV.SC-09 GV.SC-10 ID.AM-04 ID.AM-08 ID.RA-02 ID.RA-03 ID.RA-09 ID.RA-10 topicsVendor Risk Mgmt frameworks6 4 0

Official text · not licensableTitle: Monitoring, review and change management of supplier services. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.22 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.SC-01: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-04 Inventories of services provided by suppliers are maintained Loosely related Only shares CSF ID.AM-04: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources Loosely related Only shares CSF ID.RA-02: related, not a mapping ID.RA-03 Internal and external threats to the organization are identified and recorded Loosely related Only shares CSF ID.RA-03: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Loosely related Only shares CSF ID.RA-09: related, not a mapping
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt 10 loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06, GV.SC-01: related, not a mapping CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping …and 2 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 4 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping CC3.2 Risk identification and analysis Loosely related Only shares CSF ID.RA-03: related, not a mapping CC3.3 Considering the potential for fraud Loosely related Only shares CSF ID.RA-03: related, not a mapping CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-03: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 29 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-01, GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-01, GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-01, GV.SC-10: related, not a mapping …and 21 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.20 AC.L2-3.1.21 CA.L2-3.12.3	Risk Assessments; External Connections…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10…: related, not a mapping +10 more loosely related (not mappings) CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
800-53	SA-4 SA-9 SR-6 RA-9 SR-7	Acquisition Process; External System Services…	Crosswalk	Same topic: Vendor Risk Mgmt NIST SP 800-53 → ISO 27001 mapping 40 loosely related (not mappings) SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-01, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-09: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.RA-03: related, not a mapping PM-16 Threat Awareness Program Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping …and 32 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 24 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-07, GV.SC-09…: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-03: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-03: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.RA-03: related, not a mapping …and 16 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping Art.35(1) Data protection impact assessment Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-03: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 5 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-02: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 11 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-01, GV.SC-09, ID.RA-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-09, ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-01, GV.SC-09, ID.RA-09: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping Art.8(2) Identification Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping Art.13(1) Learning and evolving Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping …and 3 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-03: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.