← CIS Controls v8 in plain English

15.6 IG3

Control 15 / Service Provider Management

Monitor Service Providers

Think of it likeKeeping an eye on workers while they’re doing repairs in your home.

In plain English

Service providers are monitored as they work, so they keep meeting expectations throughout the job.

Related CSF subcategories (unofficial mapping)

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events.GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.