Draft v0.1.06 of 6 frameworks
Third-party and vendor risk management
Vendors are assessed before onboarding, bound by security terms and monitored over the relationship.
Where it appears
- SOC 2
CC9.2Assesses and manages risks associated with vendors and business partners- PCI DSS 4.0
12.8Risk to information assets associated with third-party service provider relationships is managed12.9Third-party service providers support their customers' PCI DSS compliance- NIST CSF 2.0
GV.SCCybersecurity supply chain risk management- ISO 27001:2022
A.5.19Information security in supplier relationshipsA.5.20Addressing information security within supplier agreementsA.5.21Managing information security in the ICT supply chainA.5.22Monitoring, review and change management of supplier servicesA.5.23Information security for use of cloud services- HIPAA Security Rule
164.308(b)(1)Business associate contracts and other arrangements164.314(a)Business associate contracts or other arrangements- NIST 800-53 r5
SR-3Supply chain controls and processesSR-6Supplier assessments and reviewsSA-9External system services
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Vendor management policy and tiering criteria
- Vendor inventory with data access and criticality
- Completed due diligence for a sample of vendors (SOC reports, questionnaires, AOCs)
- Contracts / DPAs / BAAs with security terms
- Annual reassessment evidence; for PCI, TPSP responsibility matrix and AOC tracking
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0