[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F15":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","15","Control 15","Service Provider Management",262,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to evaluate the service providers that hold sensitive data or run critical systems and processes, so that their platforms and data are adequately protected. It covers an inventory of providers, classification, contracts and monitoring.\n\n**In practice.** The organisation keeps a register of service providers, classifies them by data sensitivity and criticality, and sets security requirements in contracts, including incident notification and data return or deletion at exit. Higher risk providers are assessed before onboarding and reassessed periodically, and decommissioning is handled securely. Evidence includes the provider register, completed assessments, contract clauses and offboarding records.\n\n**Common gaps.** Registers are often incomplete because business units buy SaaS directly. Assessments are done once at onboarding and never repeated, and exit and data deletion are rarely verified.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fservice-provider-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":23,"title":24,"published_at":25},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":27,"title":28,"published_at":29},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":31,"title":32,"published_at":33},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":35,"title":36,"published_at":37},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":39,"title":40,"published_at":41},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":43,"title":44,"published_at":45},"zero-click-spyware-delivered-via-ad-networks-targets-journalists","Zero-Click Spyware Delivered via Ad Networks Targets Journalists","2026-10-15T12:21:25.749+00:00",{"slug":47,"title":48,"published_at":49},"north-korean-it-worker-fraud-exposes-hiring-and-identity-verification-gaps","North Korean IT Worker Fraud Exposes Hiring and Identity Verification Gaps","2026-10-14T18:21:30.184+00:00",{"slug":51,"title":52,"published_at":53},"hardware-implants-in-crypto-wallets-expose-supply-chain-risks","Hardware Implants in Crypto Wallets Expose Supply-Chain Risks","2026-10-14T18:20:46.881+00:00",{"slug":55,"title":56,"published_at":57},"cryptomus-sanctioned-for-enabling-ransomware-and-cybercrime-payments","Cryptomus Sanctioned for Enabling Ransomware and Cybercrime Payments","2026-10-14T16:20:46.489+00:00",{"slug":59,"title":60,"published_at":61},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":63,"title":64,"published_at":65},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",113,{"slug":73,"name":74,"problem":75,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",49,{"slug":78,"name":79,"problem":80,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",47,{"slug":83,"name":84,"problem":85,"stories":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",36,{"slug":88,"name":89,"problem":90,"stories":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",31,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",24,[98,104,110,115,121,127,132,137],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",154,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","28","Article 28","Processor",149,{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",102,{"family":116,"item":117,"code":118,"title":119,"together":120},"nist-800-53","sa-9","SA-9","External System Services",85,{"family":122,"item":123,"code":124,"title":125,"together":126},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",78,{"family":105,"item":128,"code":129,"title":130,"together":131},"32","Article 32","Security of processing",75,{"family":116,"item":133,"code":134,"title":135,"together":136},"ac-2","AC-2","Account Management",61,{"family":5,"item":138,"code":139,"title":140,"together":141},"3","Control 3","Data Protection",58]