third-party Controls

Third-party vendors are required to meet minimum security standards

Third-party software and services are inventoried and assessed for risk

Verify and control connections to external information systems

External service provider activities and services are monitored to detect potentially adverse events

Outcomes, capabilities, and services that the organization depends on are understood and communicated

Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

Inventories of services provided by suppliers are maintained

Third-party vendor risk is assessed and managed