SR-6 / SR-3(1) / SI-4(4) NIST SP 800-53 Rev 5

Do you monitor vendors for breach disclosures, security ratings drops, or threat-intel signals?

Demonstrate that the organization maintains continuous, automated monitoring of vendor security posture through breach disclosure tracking, security ratings surveillance, and threat intelligence integration, with documented response procedures for material findings.

Description

What this control does

This control establishes continuous monitoring of third-party vendors for security incidents, breach disclosures, deteriorating security posture, and threat intelligence indicators. Organizations subscribe to breach notification feeds, security rating services (e.g., SecurityScorecard, BitSight), and threat intelligence platforms that track vendor-related indicators of compromise. Monitoring triggers predetermined response workflows such as contract review, incident response coordination, or vendor off-boarding when material security events occur. This control operationalizes vendor risk management beyond initial assessments by maintaining real-time awareness of changing threat landscapes affecting supply chain partners.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Undetected vendor breach exposing customer data through compromised third-party access or shared infrastructure
Continued data sharing with vendors experiencing active security incidents, expanding organizational exposure
Failure to trigger incident response procedures when vendor compromise affects shared systems or data
Unauthorized access to organizational resources via compromised vendor credentials or APIs
Supply chain attacks propagating through unmonitored vendor software or service delivery channels
Reputational damage from association with publicly breached vendors when monitoring gaps delay response
Regulatory non-compliance when vendor incidents affecting controlled data go undetected beyond notification windows

Testing procedure

How an auditor verifies this control

Obtain and review the vendor monitoring policy and standard operating procedures documenting monitoring scope, frequency, data sources, and escalation thresholds.
Inventory all active monitoring tools, feeds, and services including security rating platforms, breach notification subscriptions, threat intelligence integrations, and alerting configurations.
Select a representative sample of 10-15 critical and high-risk vendors from the vendor inventory and verify each is enrolled in active monitoring systems.
Review configuration settings for breach disclosure feeds, security rating thresholds, and threat intelligence rules to confirm alert triggers align with documented risk tolerance.
Examine monitoring logs and alert history from the past 90 days to identify triggered events related to vendor breaches, rating drops, or threat indicators.
For 3-5 identified vendor security events, trace the documented response workflow from initial alert through investigation, risk assessment, and remediation or vendor communication.
Interview vendor risk management personnel to confirm monitoring frequency, alert triage procedures, and integration with incident response and contract management processes.
Test alert functionality by simulating a vendor rating drop or reviewing a recent public breach disclosure to verify detection, notification, and escalation mechanisms execute as documented.

Evidence required Collect vendor monitoring policy documents, tool configuration exports showing enrolled vendors and alert thresholds, screenshots of security rating dashboards with historical trend data, alert logs and incident tickets demonstrating triggered events and response workflows, vendor risk registers showing monitoring status and recent findings, integration documentation linking threat intelligence feeds to vendor tracking systems, and correspondence records showing vendor engagement following security events.

Pass criteria All critical and high-risk vendors are actively monitored through automated breach disclosure feeds, security rating services, or threat intelligence platforms with documented alert thresholds, and sampled security events demonstrate timely detection and execution of documented response procedures within defined SLA timeframes.