# CIS Controls v8 15.6 — Monitor Service Providers - Source: https://support.icompaas.com/compliance/cis-controls-v8/15-6-monitor-service-providers - Section: [Compliance](https://support.icompaas.com/compliance) › [CIS Critical Security Controls v8](https://support.icompaas.com/compliance/cis-controls-v8) › Control 15 — Service Provider Management - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **CIS Controls v8**·Control `15.6`·medium·Component: **Detect** ## What this control requires > Monitor service providers consistent with the enterprise's service provider management policy. Monitoring may include periodic reassessment of service provider compliance, monitoring service provider release notes, and dark web monitoring. > > — CIS Controls v8, Control 15.6 ### In plain English Monitor service providers consistent with the enterprise's service provider management policy. In practice, this means you can prove you monitor service-level controls on a defined cadence. ## Why it matters The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care. ## What an auditor looks for A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands. Within **Detect**, the assessor will trace your implementation back to the catalogue reference (Control 15.6) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Logging Monitoring **AWS.** Org-trail CloudTrail to a central log archive account, GuardDuty in every region, and Security Hub for cross-source correlation. **Azure.** Pipe every diagnostic setting into a central Log Analytics workspace; onboard Microsoft Sentinel for SIEM/SOAR. **GCP.** Aggregate audit logs in a dedicated logging project with sink to BigQuery; enable Security Command Center Premium and route findings to Chronicle SIEM. ### Operational checklist - **Monitor.** Document the trigger, the owner and the cadence. - **Scope:** service, service provider management policy, service providers, enterprise. ## Evidence to collect - **Vendor Risk Management.** `vendor_risk_management` evidence - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Monitor Service Providers. ## Common pitfalls - Per-account logging that nobody stitches together at the org level — incidents that cross accounts go undetected for days. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**NIST SP 800-171 Rev. 3 3.16.3** — External System Services](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-16-3-external-system-services) - [**NIST SP 800-53 Rev. 5 SA-5(2)** — Security-Relevant External System Interfaces](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/sa-5-2-security-relevant-external-system-interfaces) - [**BSI C5:2020 SSO-01** — Policies and instructions for controlling and monitoring third parties](https://support.icompaas.com/compliance/bsi-c5-2020/sso-01-policies-and-instructions-for-controlling-and-monitoring-third-parties) - [**ISO/IEC 27001:2022 A.8.30** — Outsourced development](https://support.icompaas.com/compliance/iso-27001-2022/a-8-30-outsourced-development) - [**SOC 2 (2017 TSC) CC9.2** — Vendor Risk Management](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/cc9-2-vendor-risk-management) ## Related controls in CIS Controls v8 - [**Control 15.2** — Establish and Maintain a Service Provider Management Policy](https://support.icompaas.com/compliance/cis-controls-v8/15-2-establish-and-maintain-a-service-provider-management-policy) - [**Control 15.1** — Establish and Maintain an Inventory of Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-1-establish-and-maintain-an-inventory-of-service-providers) - [**Control 3.8** — Document Data Flows](https://support.icompaas.com/compliance/cis-controls-v8/3-8-document-data-flows) - [**Control 15.5** — Assess Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-5-assess-service-providers) - [**Control 13.1** — Centralize Security Event Alerting](https://support.icompaas.com/compliance/cis-controls-v8/13-1-centralize-security-event-alerting) - [**Control 15.4** — Ensure Service Provider Contracts Include Security Requirements](https://support.icompaas.com/compliance/cis-controls-v8/15-4-ensure-service-provider-contracts-include-security-requirements) ## References - [Center for Internet Security — CIS Controls v8](https://www.cisecurity.org/controls/v8) - Catalogue identifier: `Control 15.6` Topics: governance riskvendor riskvendor managementsupply chain securitycontinuous monitoringlogging monitoring ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.