Information Security Program · Topic 5 of 6
Management of External Services and Third Parties
Managing security across suppliers, cloud providers, third and fourth parties: due diligence, contract terms, right to audit, monitoring and offboarding.
- 3 min
- Tier suppliers by data sensitivity, criticality and access.
- Validate self-assessments with independent evidence.
- Put security, audit, notification and exit terms in the contract before signing.
What it is
Organizations rely on external services: cloud providers, outsourcers, software vendors, consultants and the suppliers those parties use in turn (fourth parties). Each relationship can expose the organization's information. External services management makes sure security requirements are set, agreed, monitored and enforced across the whole life of each relationship.
How it works
Tiering suppliers
Not every supplier needs the same scrutiny. Suppliers are tiered by the sensitivity of the data they handle, the criticality of the service to the business and their level of access to systems. High-risk suppliers get deeper due diligence and closer monitoring.
Due diligence
| Source | What it gives |
|---|---|
| Security questionnaires | The supplier's own description of its controls; must be validated |
| Independent assurance reports | For example SOC 2 Type 2 reports or ISO/IEC 27001 certification, with their scope checked |
| On-site or remote assessments | Direct evidence for high-risk suppliers |
| Financial and reputational checks | Stability and history of incidents |
| Penetration test summaries | Evidence that technical controls were tested |
Self-reported answers, especially when every answer is "compliant", should be checked against independent evidence for higher-risk suppliers.
Contract terms
Security requirements belong in the contract before signing, when the organization has the most leverage:
- Security and privacy obligations, including standards to meet.
- Right to audit or to receive independent assurance reports.
- Incident and breach notification within defined times.
- Data location, ownership, return and destruction.
- Rules for subcontractors (fourth parties), including approval and flow-down of requirements.
- Service levels, liability and termination rights.
- Exit and transition support.
Monitoring
Ongoing monitoring covers service level performance, review of updated assurance reports and their exceptions, security ratings or alerts, incidents at the supplier, changes in ownership or subcontractors, and periodic reassessment by tier. Issues are tracked to resolution with the supplier.
Fourth parties
A supplier's own suppliers can hold or process the organization's data. Contracts should require disclosure of key subcontractors and require the supplier to pass on equivalent security obligations.
Offboarding
At the end of a relationship: revoke access, retrieve or confirm destruction of data (with evidence), recover assets and keys, and update the supplier inventory.
The organization remains accountable for its information even when a supplier processes it. Outsourcing transfers the work, never the accountability.
How the exam asks about this
- "When is the BEST time to set security requirements for a supplier?" Before the contract is signed, during selection and negotiation.
- "A supplier answers compliant to every question." Validate with independent evidence before relying on it.
- "A cloud provider uses a subcontractor for support." Check the contract covers subcontractor disclosure and flow-down of requirements.
What to remember for the exam
- Tier suppliers by data sensitivity, criticality and access.
- Validate self-assessments with independent evidence.
- Put security, audit, notification and exit terms in the contract before signing.
- Monitor continuously; reassess by tier.
- Manage fourth parties through flow-down clauses; offboard securely.
Adding security clauses after a contract is signed is difficult and expensive. Missing terms usually cannot be enforced until renewal.
Common mistakes
Treating all suppliers the same.
Trusting questionnaires without evidence.
Forgetting data return and destruction at exit.
Check yourself
What is a fourth party?
A supplier's own subcontractor or supplier that may handle the organization's data or services.
Why should security requirements be agreed before contract signature?
The organization has the most leverage then; adding them later is hard and costly.
Does outsourcing transfer accountability for data protection?
No. The organization remains accountable.
Topic 5 of 6 in Information Security Program
Test yourself on Information Security Program
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.