What it asks for. This control expects security mechanisms, service levels and service requirements of network services to be identified, implemented and monitored. The aim is to ensure security in the use of network services, whether provided internally or by external providers.
In practice. Good practice means defining the security features needed from internal and external network services, such as connectivity providers, VPN, DNS and content delivery services, and including them in agreements. The provider's ability to deliver them is checked and monitored. Auditors look for requirements in contracts or service descriptions, configuration evidence and monitoring records.
Common gaps. Typical gaps are network services bought on standard terms without security requirements and no monitoring of provider performance against them. Responsibilities for configuration of managed network services are often unclear. Changes by the provider are also not always communicated.