Service Provider Management Policy Template for CIS Control 15
In our modern, connected world, enterprises rely on vendors and partners to help manage their data or rely on third-party infrastructure to manage core applications or functions. There have been numerous examples where third-party breaches have significantly impacted an enterprise; for example, as early as the late 2000s, payment cards were compromised after attackers infiltrated smaller third-party vendors in the retail industry. More recent examples include ransomware attacks that impact an enterprise indirectly due to one of their service providers being locked down, causing disruption to business. Or worse, if directly connected, a ransomware attack could encrypt data on the main enterprise.
Most data security and privacy regulations require their protection extend to third service providers, such as with Health Insurance Portability and Accountability Act (HIPAA) Business Associate agreements in healthcare, Federal Financial Institutions Examination Council (FFIEC) requirements for the financial industry, and the United Kingdom (UK) Cyber Essentials. Third-party trust is a core Governance Risk and Compliance (GRC) function, as risks that are not managed within the enterprise are transferred to entities outside the enterprise.
While reviewing the security of third-parties has been a task performed for decades, there is not a universal standard for assessing security. Many service providers are being audited by their customers multiple times a month, affecting their own productivity. This is because every enterprise has a different “checklist,” or set of standards, to grade the service provider. Very few industry standards exist for grading service providers such as in finance, with the Shared Assessments Program, or in higher education, with their Higher Education Community Vendor Assessment Toolkit (HECVAT). Insurance companies selling cybersecurity policies also have their own measurements.
This policy template is meant to supplement the CIS Controls v8. The policy statements included within this document can be used by all CIS Implementation Groups (IGs) but are specifically geared toward Safeguards in Implementation Group 1 (IG1).
