Does your organization have procedures to monitor and log all maintenance and administrative activities performed by external providers on your systems, both remotely and onsite?
Explanation
External providers often require privileged access to perform maintenance or administrative tasks on your systems, creating potential security risks if these activities are not properly monitored. Monitoring should include tracking when external providers connect to systems, what actions they perform, and ensuring these activities align with approved change requests or service agreements.
Evidence could include logs of external provider access (such as VPN connection logs, admin session recordings), documented procedures for monitoring third-party activities, screenshots of monitoring dashboards, or audit reports showing review of external provider activities.
Implementation Example
Monitor remote and onsite administration and maintenance activities that external providers perform on organizational systems
ID: DE.CM-06.283
Context
- Function
- DE: DETECT
- Category
- DE.CM: Continuous Monitoring
- Sub-Category
- External service provider activities and services are monitored to find potentially adverse events
Related questions
- Does your organization have a system in place to monitor DNS, BGP, and other critical network services for suspicious or malicious activities?
- Does your organization implement network monitoring controls to detect and alert on unauthorized endpoint connections to both wired and wireless networks?
- Does your organization have a process to regularly monitor facilities for unauthorized or rogue wireless networks?
- Does your organization regularly compare actual network traffic flows against established baselines to detect and investigate deviations?
- Does your organization continuously monitor network communications to detect changes in security postures as part of a zero trust architecture?
- Does your organization monitor physical access control logs for unusual patterns and failed access attempts?
