SSO-02 Risk assessment of service providers and suppliers
Assess every service provider and supplier for risk before it contributes to the cloud service, and revalidate at least yearly, covering protection needs of the information handled, consequences of a breach, and dependen
4
artefacts
0
held by a system
2
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Completed pre engagement risk assessments for a sample of newly onboarded suppliers · Vendor register / contract repository
- Annual reassessment schedule listing the date of the last review per supplier · Vendor register / contract repository
governing documentDocuments that govern the control
- Protection needs analysis recording confidentiality, integrity, availability and authenticity ratings · Vendor register / contract repository
- Dependency analysis noting substitutability and the alternative providers considered · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Supplier began delivering before its assessment was completed
- Reassessments overdue beyond twelve months for long standing suppliers
- Scores recorded with no analysis of the impact a breach would have on service delivery
- Dependency and absence of alternatives never evaluated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSSO-01 Policies and instructions for controlling and monitoring third parties · SSO-03 Directory of service providers and suppliers