SSO-04 Monitoring of compliance with requirements
Verify that third parties meet agreed security and legal obligations by reviewing service quality reports, management system certificates, independent assurance reports and their vulnerability and incident records, at a
4
artefacts
1
held by a system
2
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Mapping of monitoring frequency to each supplier's assigned risk class · SIEM / log platform
periodic reviewEvidence produced at each review
- Review notes evidencing evaluation of a supplier's service quality reporting · Vendor register / contract repository
- Correspondence obtaining a supplier's vulnerability and incident handling records · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Register of assurance reports and certificates received from suppliers with expiry dates · Vendor register / contract repository
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Certificates collected and filed but never read or evaluated
- Monitoring performed at a uniform cadence irrespective of supplier criticality
- Qualifications and exceptions in a supplier assurance report not carried into the provider's own risk treatment
- Monitoring outcomes never used to refresh the supplier risk rating
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSSO-03 Directory of service providers and suppliers · SSO-05 Exit strategy for the receipt of benefits