SOC 2 (Systems and Organization Controls)

Requirement

CC9.2: Partner risk management

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

The entity assesses and manages risks associated with vendors and business partners.

Points of focus:

- Establishes Requirements for Vendor and Business Partner Engagements
- Assesses Vendor and Business Partner Risks
- Assigns Responsibility and Accountability for Managing Vendors and Business Partners
- Establishes Communication Protocols for Vendors and Business Partners
- Establishes Exception Handling Procedures From Vendors and Business Partners
- Assesses Vendor and Business Partner Performance
- Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessments
- Implements Procedures for Terminating Vendor and Business Partner Relationships
- Obtains Confidentiality Commitments from Vendors and Business Partners
- Assesses Compliance With Confidentiality Commitments of Vendors and Business Partners
- Obtains Privacy Commitments from Vendors and Business Partners
- Assesses Compliance with Privacy Commitments of Vendors and Business Partners

See how Cyberday guides you to fulfill this requirement:

Start free trial

This requirement is part of the framework:

SOC 2 (Systems and Organization Controls)

Other requirements of the framework

CC9.2: Partner risk management

Best practices

How to implement:

CC9.2: Partner risk management

This policy on

CC9.2: Partner risk management

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

The entity assesses and manages risks associated with vendors and business partners.

Points of focus:

- Establishes Requirements for Vendor and Business Partner Engagements
- Assesses Vendor and Business Partner Risks
- Assigns Responsibility and Accountability for Managing Vendors and Business Partners
- Establishes Communication Protocols for Vendors and Business Partners
- Establishes Exception Handling Procedures From Vendors and Business Partners
- Assesses Vendor and Business Partner Performance
- Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessments
- Implements Procedures for Terminating Vendor and Business Partner Relationships
- Obtains Confidentiality Commitments from Vendors and Business Partners
- Assesses Compliance With Confidentiality Commitments of Vendors and Business Partners
- Obtains Privacy Commitments from Vendors and Business Partners
- Assesses Compliance with Privacy Commitments of Vendors and Business Partners

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

CC9.2: Partner risk management

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

No other tasks found.

Complete these tasks in Cyberday ISMS ->

How to comply with this requirement

In Cyberday, requirements and controls are mapped to universal tasks. Each requirement is fulfilled with one or multiple tasks.

Here's a list of tasks that help you comply with the requirement

CC9.2: Partner risk management

of the framework

SOC 2 (Systems and Organization Controls)

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

Documentation of partner contract status

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Documentation of partner contract status

Članak 30.1.d: Sigurnost lanca opskrbe NIS2 Croatia

9.4 §: Toimitusketjun hallinta ja valvonta Kyberturvallisuuslaki

30 § 3.4°: La sécurité de la chaîne d'approvisionnement NIS2 Belgium

30 § 4°: Définir et contrôler les mesures de sécurité requises pour la chaîne d'approvisionnement NIS2 Belgium

2.1.9: Maintain security responsibility during outsourcing NSM ICT-SP

Criteria for suppliers of high priority data systems

Critical

High

Normal

Low

System management

Data system procurement

Criteria for suppliers of high priority data systems

Članak 30.1.d: Sigurnost lanca opskrbe NIS2 Croatia

9.4 §: Toimitusketjun hallinta ja valvonta Kyberturvallisuuslaki

1.3.3: Use of approved external IT services TISAX

6.1.1: Partner Information security TISAX

30 § 3.4°: La sécurité de la chaîne d'approvisionnement NIS2 Belgium

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Monitoring suppliers' compliance with security requirements

Članak 30.2: Dobavljačka kibernetička sigurnost i rizici NIS2 Croatia

1.2.4: Definition of responsibilities with service providers TISAX

30 § 4°: Définir et contrôler les mesures de sécurité requises pour la chaîne d'approvisionnement NIS2 Belgium

2.1.10: Review the service provider’s security when outsourcing NSM ICT-SP

ID.SC-3: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.CyberFundamentals

Definition of supplier-specific responsible persons

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Definition of supplier-specific responsible persons

8.1.2: Ownership of assets ISO 27001

15.2.2: Managing changes to supplier services ISO 27001

ID.SC-4: Audit suppliers and third-party partners NIST

CC9.2: Partner risk management SOC 2

ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.CyberFundamentals

Criteria for high priority partners

Critical

High

Normal

Low

Partner management

Supplier security

Criteria for high priority partners

Članak 30.1.d: Sigurnost lanca opskrbe NIS2 Croatia

9.4 §: Toimitusketjun hallinta ja valvonta Kyberturvallisuuslaki

1.3.3: Use of approved external IT services TISAX

6.1.1: Partner Information security TISAX

30 § 3.4°: La sécurité de la chaîne d'approvisionnement NIS2 Belgium

Managing changes to supplier services

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Managing changes to supplier services

15.2.2: Managing changes to supplier services ISO 27001

HAL-16.1: Hankintojen turvallisuus - sopimukset Julkri

CC3.4: Identification and assesment of changes SOC 2

CC9.2: Partner risk management SOC 2

Art. 10: Dienstleister CSV

Consideration of partner risks in information security risk management

Critical

High

Normal

Low

Risk management and leadership

Risk management

Consideration of partner risks in information security risk management

CC9.2: Partner risk management SOC 2

1.3.3: Use of approved external IT services TISAX

30 § 2°: Évaluation des risques et mesures de gestion NIS2 Belgium

19.2.i (risk management): Insider risk management NIS2 Malta

12.1: Mesures de sécurité et gestion des risques NIS2 Luxembourg

Collection and monitoring of supplier-specific privacy commitments

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Collection and monitoring of supplier-specific privacy commitments

CC9.2: Partner risk management SOC 2

2.1.4: Reduce the risk of targeted manipulation of ICT products in the supply chain NSM ICT-SP

Complete these tasks in Cyberday ISMS ->

The ISMS component hierachy

When building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.

Framework

Sets the overall compliance standard or regulation your organization needs to follow.

Requirements

Break down the framework into specific obligations that must be met.

Tasks

Concrete actions and activities your team carries out to satisfy each requirement.

Policies

Documented rules and practices that are created and maintained as a result of completing tasks.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍

Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.

Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.

Do it once - we automatically apply it to all current and future frameworks.

Start free trial