+SA-09(04) Consistent Interests of Consumers and Providers

SA-09(04) Consistent Interests of Consumers and Providers

Control

Take the following actions to verify that the interests of [Assignement: external service providers] are consistent with and reflect organizational interests: [Assignement: actions].

Discussion

As organizations increasingly use external service providers, it is possible that the interests of the service providers may diverge from organizational interests. In such situations, simply having the required technical, management, or operational controls in place may not be sufficient if the providers that implement and manage those controls are not operating in a manner consistent with the interests of the consuming organizations. Actions that organizations take to address such concerns include requiring background checks for selected service provider personnel; examining ownership records; employing only trustworthy service providers, such as providers with which organizations have had successful trust relationships; and conducting routine, periodic, unscheduled visits to service provider facilities.

Assessment Objective

[Assignement: actions] are taken to verify that the interests of [Assignement: external service providers] are consistent with and reflect organizational interests.

Assessment Method

Examine

System and services acquisition policy procedures addressing external system services acquisition contracts for the system, system component, or system service solicitation documentation acquisition documentation service level agreements organizational security requirements/safeguards for external service providers personnel security policies for external service providers assessments performed on external service providers system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities external providers of system services organizational personnel with supply chain risk management responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SA-09(04) Consistent Interests of Consumers and Providers – Assessment Procedure
is blocked by Conflict of Interests