DE.CM-06 says external service provider activities and services are monitored to find potentially adverse events. Your vendors have access to your systems, data or build pipeline. This outcome asks you to watch what they do with that access and to notice when their service behaves unexpectedly. No CSF certification exists.
What good looks like
You keep a list of providers with access, and each has a named internal owner. Remote admin sessions by a provider are logged and reviewable. Cloud and SaaS services are watched for deviations such as new integrations, unusual API volume or changed permissions. Provider status and security notices are read, not just received.
How to implement it
- List every provider with access to production, source code, customer data or admin consoles.
- Give providers named accounts, never shared ones, so their actions are attributable.
- Log and review their sessions. Require them to use your access path, with MFA.
- Watch the audit logs of your SaaS and cloud tools for new OAuth grants and API keys.
- Include software suppliers: monitor the packages they ship you. Scan dependencies for new known vulnerabilities, for instance with the free in browser scan at https://gold.safeguard.sh/scan.
- Remove access when a contract ends.
A worked example
A company uses a managed IT provider to administer its servers. Before the review, the provider logged in with one shared account. The security lead replaces it with named accounts that require MFA and route through a bastion host that records sessions.
Each month she reviews the session list. In March she sees a login at 03:00 from a technician who normally works in business hours. A call to the provider confirms planned maintenance that nobody had told the company about. Nothing was wrong, but the company adds a rule that off hours work needs advance notice.
On the SaaS side, the audit log shows a new OAuth grant from a vendor tool with read access to all shared files. The team revokes it and asks the vendor to request narrower access.
Evidence to collect
- The provider list with owners and access level.
- Session logs or audit exports for a sample provider.
- A review record showing someone read them.
- Offboarding tickets for ended providers.
Try it yourself
Click through it at your own pace, or open it full screen.
Common gaps
Shared vendor logins. Access granted for a project and never removed. Reviews happen at onboarding only. Nobody watches the software your vendors deliver.
Quick check
Is a vendor questionnaire enough for DE.CM-06?
No. Questionnaires assess a vendor at one moment. DE.CM-06 is about ongoing monitoring of what the provider actually does.
Sources
- NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters
