800-53 · SA System and Services Acquisition
SA-9
External System Services
frameworkNIST SP 800-53 Rev 5.2
sectionSA System and Services Acquisition
csf 2.0DE.CM-06 GV.OC-05 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-04
topicsCloud Security, Vendor Risk Mgmt
frameworks7 5 0
Official texta. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls];
b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and
c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.AM-04ID.RA-10PR.IR-01PR.PS-01 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security6 loosely related (not mappings)GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Only shares CSF GV.OC-05: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Only shares CSF ID.AM-02: related, not a mapping |
| ISO 27001 | A.5.19A.5.20A.5.22A.5.23A.5.2A.5.4A.5.8A.5.14A.8.21 | Information security in supplier relationships; Addressing information security within supplier agreements… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security NIST SP 800-53 → ISO 27001 mapping 10 loosely related (not mappings)Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-02: related, not a mapping …and 2 more in the downloads |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.5CIS 15.6CIS 15.4CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt9 loosely related (not mappings)CIS 2.1 Establish and Maintain a Software Inventory Only shares CSF ID.AM-02: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 1 more in the downloads |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
| PCI DSS | 12.8.112.8.212.8.312.8.412.8.5 | List of third-party service providers kept; Written agreements with service providers… | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt27 loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-07, GV.SC-09: related, not a mapping …and 19 more in the downloads |
| CMMC | AC.L2-3.1.20 | External Connections | Crosswalk | Same topic: Cloud Security10 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping …and 2 more in the downloads |
| HIPAA | §164.308(b)(1)§164.314(a)§164.308(b)(4)§164.314(a)(2)(i)§164.314(a)(2)(ii)§164.314(a)(2)(iii)§164.314(b)(2)(iii) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements… | Crosswalk | Same topic: Cloud Security, Vendor Risk Mgmt NIST HIPAA → SP 800-53 crosswalk 14 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-06: related, not a mapping …and 6 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)Art.30(1) Records of processing activities Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Crosswalk | Same topic: Vendor Risk Mgmt, Cloud Security4 loosely related (not mappings) |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| DORA | Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3) | General principles; General principles… | Editorial | Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping |
| Cyber Essentials | CE 4 | User Access Control | Editorial | Same topic: Cloud Security (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.