Security requirements and accountability for outsourced services must extend through subcontracting arrangements. Reviewing the contracted third party’s agreements with its external provider establishes whether the subcontractor is bound to appropriate security obligations, monitoring, incident-response requirements, and oversight rights. NIST guidance requires organizations to define external-service-provider responsibilities and monitor those providers’ compliance; the organization retains responsibility for managing the resulting risk.
Community Discussion