CC9.2 Risk mitigation activities include assessment of vendor and business partner controls
Assesses and manages risks associated with vendors and business partners.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Due diligence records performed before engagement, at the depth the tier requires · Vendor register / contract repository
- Evidence of ongoing monitoring, such as review of assurance reports with complementary user entity control consideration, and follow up on exceptions noted in them · SIEM / log platform
- Evidence of termination handling, including return or deletion of data and revocation of access · HR system / LMS
governing documentDocuments that govern the control
- The vendor and business partner inventory, with risk tiering based on data access and criticality · Vendor register / contract repository
- Contractual commitments covering confidentiality, security requirements, incident notification and the right to assess · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Assurance reports collected and filed with no review of the exceptions or of the complementary user entity controls they assume the entity performs
- Inventory covering vendors known to procurement, missing services engaged directly by teams
- Due diligence performed at onboarding with no reassessment during a multi year relationship
- Subservice organisations engaged by the vendor never identified, so risk stops at the first tier
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC9.1 Identifies, selects and develops risk mitigation activities · P1.1 Privacy notice provides clear notice about privacy practices