ID.AM-04.129

Does your organization maintain a comprehensive inventory of all external services, including cloud services (IaaS, PaaS, SaaS), APIs, and other externally hosted application services?

Explanation

Maintaining an inventory of external services helps identify potential security risks, compliance requirements, and dependencies that could impact your organization. This inventory should include cloud services like AWS or Azure (IaaS), Heroku or Google App Engine (PaaS), Microsoft 365 or Salesforce (SaaS), as well as any third-party APIs and externally hosted applications your systems interact with. An acceptable deliverable would be a documented inventory spreadsheet or database that includes details such as service name, provider, purpose, data classification, business owner, technical owner, contract renewal dates, and security assessment status for each external service.

Implementation Example

Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services

ID: ID.AM-04.129

Context

Function: ID: IDENTIFY
Category: ID.AM: Asset Management
Sub-Category: Inventories of services provided by suppliers are maintained

ResponseHub is the product I wish I had when I was a CTO

Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.

As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!

I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.

Neil Cameron

Founder, ResponseHub