[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-9":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-9","SA-9","External System Services",126,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Providers of external system services must comply with the organisation's security and privacy requirements and controls, oversight roles must be defined, and the organisation must monitor provider compliance on an ongoing basis.\n\n**In practice.** This means security requirements in contracts, due diligence before onboarding cloud and managed service providers, and ongoing monitoring through assurance reports such as SOC 2 or ISO\u002FIEC 27001 certificates, questionnaires and service reviews. Auditors expect contracts with security clauses, assessment records and a register of third-party services. For European financial entities this overlaps heavily with DORA ICT third-party risk requirements.\n\n**Common gaps.** Organisations often assess suppliers only at onboarding and then lose track. Many SaaS services are bought outside procurement, so they never receive security review.","a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls];\n  b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and\n  c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].\nDiscussion: External system services are provided by an external provider, and the organization has no direct control over the implementation of the required controls or the assessment of control effectiveness. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with authorizing officials. For services external to organizations, a chain of trust requires that organizations establish and retain a certain level of confidence that each provider in the consumer-provider relationship provides adequate protection for the services rendered. The extent and nature of this chain of trust vary based on relationships between organizations and the external providers. Organizations document the basis for the trust relationships so that the relationships can be monitored. External system services documentation includes government, service providers, end user security roles and responsibilities, and service-level agreements. Service-level agreements define the expectations of performance for implemented controls, describe measurable outcomes, and identify remedies and response requirements for identified instances of noncompliance.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},142,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":26,"title":27,"published_at":28},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":30,"title":31,"published_at":32},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",{"slug":34,"title":35,"published_at":36},"third-party-screenconnect-add-on-abused-to-bypass-auth-and-deploy-rogue-rmm-tools","Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools","2026-11-12T21:20:21.093+00:00",{"slug":38,"title":39,"published_at":40},"maersk-ransomware-hit-stems-from-unretired-legacy-system-inherited-in-acquisition","Maersk Ransomware Hit Stems from Unretired Legacy System Inherited in Acquisition","2026-11-12T19:20:58.818+00:00",{"slug":42,"title":43,"published_at":44},"third-party-rmm-extension-abused-to-breach-nearly-50-organizations-via-screenconnect","Third-Party RMM Extension Abused to Breach Nearly 50 Organizations via ScreenConnect","2026-11-12T17:21:51.126+00:00",{"slug":46,"title":47,"published_at":48},"third-party-ai-vendor-breach-exposes-notion-customer-chat-data","Third-Party AI Vendor Breach Exposes Notion Customer Chat Data","2026-11-12T12:21:15.592+00:00",{"slug":50,"title":51,"published_at":52},"legacy-acquisition-system-exposes-maersk-to-data-theft-and-extortion","Legacy Acquisition System Exposes Maersk to Data Theft and Extortion","2026-11-12T11:20:57.065+00:00",{"slug":54,"title":55,"published_at":56},"acquired-it-systems-become-a-data-breach-vector-for-maersk","Acquired IT Systems Become a Data Breach Vector for Maersk","2026-11-12T09:20:20.555+00:00",{"slug":58,"title":59,"published_at":60},"third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","2026-11-12T00:20:24.197+00:00",{"slug":62,"title":63,"published_at":64},"legacy-system-from-acquisition-becomes-entry-point-for-5m-ransomware-demand","Legacy System from Acquisition Becomes Entry Point for $5M Ransomware Demand","2026-11-11T22:20:43.504+00:00",{"slug":66,"title":67,"published_at":68},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts-1794432025691","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","2026-11-11T21:20:25.576+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",48,{"slug":76,"name":77,"problem":78,"stories":79},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",34,{"slug":81,"name":82,"problem":83,"stories":84},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",29,{"slug":86,"name":87,"problem":88,"stories":89},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",25,{"slug":91,"name":92,"problem":93,"stories":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",20,{"slug":96,"name":97,"problem":98,"stories":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[100,106,112,117,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","15","Control 15","Service Provider Management",88,{"family":107,"item":108,"code":109,"title":110,"together":111},"gdpr","28","Article 28","Processor",79,{"family":113,"item":114,"code":115,"title":115,"together":116},"itil","overview","ITIL",69,{"family":107,"item":118,"code":119,"title":120,"together":121},"32","Article 32","Security of processing",59,{"family":107,"item":123,"code":124,"title":125,"together":126},"33","Article 33","Notification of a personal data breach to the supervisory authority",38,{"family":128,"item":129,"code":130,"title":131,"together":126},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":101,"item":133,"code":134,"title":135,"together":136},"3","Control 3","Data Protection",35,{"family":107,"item":138,"code":139,"title":140,"together":141},"5","Article 5(1)(f)","Principles relating to processing of personal data",32]