[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F15":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","15","Control 15","Service Provider Management",262,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to evaluate the service providers that hold sensitive data or run critical systems and processes, so that their platforms and data are adequately protected. It covers an inventory of providers, classification, contracts and monitoring.\n\n**In practice.** The organisation keeps a register of service providers, classifies them by data sensitivity and criticality, and sets security requirements in contracts, including incident notification and data return or deletion at exit. Higher risk providers are assessed before onboarding and reassessed periodically, and decommissioning is handled securely. Evidence includes the provider register, completed assessments, contract clauses and offboarding records.\n\n**Common gaps.** Registers are often incomplete because business units buy SaaS directly. Assessments are done once at onboarding and never repeated, and exit and data deletion are rarely verified.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fservice-provider-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},298,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":24,"title":25,"published_at":26},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":28,"title":29,"published_at":30},"third-party-ai-vendor-breach-exposes-notion-customer-chat-data","Third-Party AI Vendor Breach Exposes Notion Customer Chat Data","2026-11-12T12:21:15.592+00:00",{"slug":32,"title":33,"published_at":34},"third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","2026-11-12T00:20:24.197+00:00",{"slug":36,"title":37,"published_at":38},"dual-breaches-at-fireworks-ai-expose-supply-chain-and-access-control-gaps","Dual Breaches at Fireworks AI Expose Supply Chain and Access Control Gaps","2026-11-10T17:22:22.909+00:00",{"slug":40,"title":41,"published_at":42},"iris-ohyama-breach-77-million-records-exposed-via-third-party-cloud-service","Iris Ohyama Breach: 7.7 Million Records Exposed via Third-Party Cloud Service","2026-11-10T08:22:41.736+00:00",{"slug":44,"title":45,"published_at":46},"sega-newsletter-breach-third-party-email-provider-exposes-22-million-subscribers","SEGA Newsletter Breach: Third-Party Email Provider Exposes 2.2 Million Subscribers","2026-11-09T23:20:41.873+00:00",{"slug":48,"title":49,"published_at":50},"compromised-third-party-iam-credentials-enable-cross-account-aws-secret-theft","Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft","2026-11-09T20:20:24.804+00:00",{"slug":52,"title":53,"published_at":54},"third-party-marketing-vendor-exposes-who-gives-a-crap-customer-data","Third-Party Marketing Vendor Exposes Who Gives A Crap Customer Data","2026-11-09T15:21:22.436+00:00",{"slug":56,"title":57,"published_at":58},"iris-plaza-cloud-breach-exposes-77-million-customers-via-third-party-service","Iris Plaza Cloud Breach Exposes 7.7 Million Customers via Third-Party Service","2026-11-09T13:20:40.563+00:00",{"slug":60,"title":61,"published_at":62},"iris-ohyama-cloud-breach-exposes-77m-customer-records-via-third-party-service","Iris Ohyama Cloud Breach Exposes 7.7M Customer Records via Third-Party Service","2026-11-09T13:20:21.863+00:00",{"slug":64,"title":65,"published_at":66},"service-provider-compromise-leads-to-133m-bank-heist","Service Provider Compromise Leads to $133M Bank Heist","2026-11-09T11:22:43.404+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",135,{"slug":74,"name":75,"problem":76,"stories":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",58,{"slug":79,"name":80,"problem":81,"stories":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",52,{"slug":84,"name":85,"problem":86,"stories":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",41,{"slug":89,"name":90,"problem":91,"stories":92},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",35,{"slug":94,"name":95,"problem":96,"stories":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",31,[99,105,111,116,121,127,133,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",154,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","28","Article 28","Processor",151,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",102,{"family":106,"item":117,"code":118,"title":119,"together":120},"32","Article 32","Security of processing",89,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-800-53","sa-9","SA-9","External System Services",88,{"family":128,"item":129,"code":130,"title":131,"together":132},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",78,{"family":5,"item":134,"code":135,"title":136,"together":137},"3","Control 3","Data Protection",62,{"family":122,"item":139,"code":140,"title":141,"together":142},"ac-2","AC-2","Account Management",61]