SA-9, External System Services, asks three things of the organization. Require that providers of external system services comply with your security and privacy requirements and employ controls you name. Define and document oversight and user roles and responsibilities for those services. And employ processes, methods and techniques you choose to monitor the providers' control compliance on an ongoing basis.
800-53 binds US federal systems, and others through contract. For small and mid size companies it is a reference, and in practice it is vendor management: the control behind most third party questionnaires.
What it means in practice
The guidance starts from an uncomfortable fact. With an external service, you have no direct control over how the controls are implemented or how their effectiveness is assessed. Yet responsibility for the risk stays with you. The record puts it as a chain of trust: you need some level of confidence that each provider protects the service adequately, and the basis for that trust should be documented so it can be monitored.
Relationships take many forms, such as contracts, licensing agreements, joint ventures and supply chain exchanges. Documentation includes security roles and responsibilities and service level agreements. An SLA defines expectations of performance for controls, describes measurable outcomes, and identifies remedies and response requirements for noncompliance.
The enhancements show where it can go: SA-9.1 Risk Assessments and Organizational Approvals, SA-9.2 Identification of Functions, Ports, Protocols, and Services, SA-9.3 Establish and Maintain Trust Relationship with Providers, SA-9.4 Consistent Interests of Consumers and Providers, SA-9.5 Processing, Storage, and Service Location, SA-9.6 Organization-controlled Cryptographic Keys, SA-9.7 Organization-controlled Integrity Checking and SA-9.8 Processing and Storage Location, U.S. Jurisdiction.
Evidence to collect
- A vendor register listing each external service, its owner, data handled and criticality.
- The contract, order form or terms for each, with the security requirements you placed on them.
- A responsibility matrix for each service: what the provider does, what you do.
- Assessment results from the provider, such as an audit report or completed questionnaire, with the date.
- Records of ongoing monitoring: renewal reviews, incident notices, status page checks.
- Approval records for new services.
Common gaps
A vendor register that stops at purchasing. Services adopted by a team on a company card never appear.
A review at signing and nothing since. The third part of the control is about ongoing monitoring.
Roles that live in assumption. Who rotates the keys? Who reviews the access logs? If the matrix does not say, an auditor will ask.
Collecting reports without reading them. A report with a qualified opinion or an exception list needs a response from you.
How to implement it
- Build the register from finance records, single sign on logs and engineering input.
- Tier vendors by the data they hold and the damage if they fail.
- Set requirements per tier and put them in contracts.
- Write the responsibility matrix for your top tier first.
- Choose monitoring methods: yearly report review, notice subscriptions, periodic access review.
- Record every review and its outcome, including the decision to accept a gap.
The demo walks through a vendor review so you can see the steps in order.
Click through it at your own pace, or open it full screen.
Quick check
Who holds the risk when a provider fails to implement a control?
According to the guidance, responsibility for managing risks from external services remains with the organization, even though it has no direct control over the provider's implementation.
What does an SLA add to this control?
It defines performance expectations for controls, measurable outcomes, and remedies and response requirements for noncompliance.
