What it asks for. This control asks organisations to evaluate the service providers that hold sensitive data or run critical systems and processes, so that their platforms and data are adequately protected. It covers an inventory of providers, classification, contracts and monitoring.
In practice. The organisation keeps a register of service providers, classifies them by data sensitivity and criticality, and sets security requirements in contracts, including incident notification and data return or deletion at exit. Higher risk providers are assessed before onboarding and reassessed periodically, and decommissioning is handled securely. Evidence includes the provider register, completed assessments, contract clauses and offboarding records.
Common gaps. Registers are often incomplete because business units buy SaaS directly. Assessments are done once at onboarding and never repeated, and exit and data deletion are rarely verified.