Skip to main content
← All controls
SR-6 / A.15.1.3 / CIS-15.2 NIST SP 800-161 Rev 1

Do you use a continuous security-rating service (BitSight, SecurityScorecard, UpGuard) for Tier 1 vendors?

Demonstrate that the organization continuously monitors the external security posture of Tier 1 vendors using an automated security rating platform, and that findings inform risk management decisions.

Description

What this control does

This control requires the organization to subscribe to and actively utilize a third-party continuous security rating service (such as BitSight, SecurityScorecard, UpGuard, or similar) to monitor the cybersecurity posture of Tier 1 vendors—those critical to business operations or handling sensitive data. These services aggregate external threat intelligence, scan for vulnerabilities, analyze public-facing infrastructure, and provide dynamic risk scores based on observable security behaviors. Continuous monitoring enables real-time detection of vendor security degradation, breach indicators, or configuration weaknesses that may not surface during point-in-time assessments, thereby supporting proactive third-party risk management.

Control objective

What auditing this proves

Demonstrate that the organization continuously monitors the external security posture of Tier 1 vendors using an automated security rating platform, and that findings inform risk management decisions.

Associated risks

Risks this control addresses

  • Tier 1 vendor compromise goes undetected between annual assessments, allowing attackers to pivot into the organization's environment through trusted integrations
  • Vendors suffer security degradation (e.g., expired certificates, exposed databases, malware infections) without triggering contractual breach notifications or remediation workflows
  • Supply chain attacks leverage vendor infrastructure weaknesses not visible through self-assessments or questionnaires alone
  • Inadequate visibility into vendor patching cadence and vulnerability management practices increases the attack surface inherited from third parties
  • Public-facing vendor assets experience misconfigurations, data leaks, or exposed credentials that create immediate exploitation pathways
  • Lack of real-time vendor security intelligence prevents timely incident response coordination when vendors are actively compromised
  • Tier 1 vendor selection and retention decisions rely on outdated point-in-time data rather than current security performance trends

Testing procedure

How an auditor verifies this control

  1. Obtain and review the organization's Tier 1 vendor inventory, including vendor names, criticality classifications, and data access privileges.
  2. Verify active subscription to at least one continuous security rating service by requesting account access credentials, license documentation, or platform screenshots showing current subscription status.
  3. Log into the security rating platform and confirm that all identified Tier 1 vendors are enrolled for continuous monitoring, capturing screenshots of the monitored vendor portfolio.
  4. Select a sample of 5-10 Tier 1 vendors and review their current security ratings, historical score trends, and identified security issues within the platform.
  5. Request documentation of thresholds, policies, or procedures that define how security rating alerts trigger vendor risk reviews, remediation requests, or escalation workflows.
  6. Interview vendor risk management personnel to understand how security rating data integrates into vendor onboarding, periodic reviews, contract renewals, and incident response protocols.
  7. Review evidence of at least three instances within the past 12 months where security rating findings led to documented vendor engagement, remediation tracking, or risk acceptance decisions.
  8. Validate that security ratings are refreshed at intervals consistent with the service's capabilities (daily, weekly, or continuously) by examining timestamp metadata for monitored vendors.
Evidence required The auditor collects vendor inventory documentation with Tier 1 classifications, subscription invoices or license agreements for the security rating service, screenshots from the platform showing enrolled vendors and their current ratings, policy documents defining risk thresholds and response procedures, and remediation tickets or email correspondence demonstrating action taken based on rating alerts. Additionally, audit logs or exports from the platform showing scan frequency and historical score trends for sampled vendors, along with meeting minutes or decision records where rating data informed vendor risk decisions.
Pass criteria The organization maintains an active subscription to a continuous security rating service, all Tier 1 vendors are enrolled and monitored, rating data is updated at least weekly, and documented evidence demonstrates that findings inform vendor risk management activities within defined response timeframes.