third-party
third-party Controls
8 controls across 4 frameworks.
CISA CPG
CMMC L1
NIST CSF
de-cm-6
External service provider activities and services are monitored to detect potentially adverse events
Detect / Continuous Monitoring
high 4h
gv-oc-5
Outcomes, capabilities, and services that the organization depends on are understood and communicated
Govern / Organizational Context
high 4h
gv-rm-5
Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
Govern / Risk Management Strategy
high 3h
id-am-4
Inventories of services provided by suppliers are maintained
Identify / Asset Management
high 4h