NIST CSF 2.0 ID.AM-04: Inventory Supplier Services

ID.AM-04 says inventories of services provided by suppliers are maintained. Think of every SaaS tool, cloud platform, API and hosted service your company relies on. If it is not on the list, nobody is assessing its risk.

CSF is voluntary guidance and there is no CSF certification.

What good looks like

A single list of external services with an owner, the data each one touches, and a link to the supplier risk record. The list is updated before a new service goes live, not discovered afterward.

How to implement it

1. Pull candidates from three places: expense and accounts payable data, your SSO or identity provider app list, and OAuth grants in your workspace.
2. Add cloud and API services found in code and configuration, such as keys for external APIs.
3. Record owner, purpose, data types shared and contract renewal date.
4. Add a gate: new tools need an entry before purchase approval.
5. Reconcile every quarter against spend.

A worked example

Finance exports twelve months of card and invoice data and finds 94 software vendors. The identity provider lists 58 connected apps. Eleven vendors appear in spend but not in SSO, which usually means a team signed up with a personal login. Four SSO apps have no matching spend, so they are free tiers. The combined list has 105 services. Tagging each with the data it touches shows nine that hold customer data and deserve a supplier risk review.

Evidence to collect

• The service inventory with dates.
• The reconciliation notes.
• The purchase approval step that requires an entry.

Common gaps

• Free tier tools adopted by a team never reach finance, so they never reach the list.
• The list has no data classification, so risk cannot be prioritized.
• OAuth apps with broad access to email or storage are overlooked.

Quick check

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf