Does your organization maintain a comprehensive inventory of all external services, including cloud services (IaaS, PaaS, SaaS), APIs, and other externally hosted application services?
Explanation
Maintaining an inventory of external services helps identify potential security risks, compliance requirements, and dependencies that could impact your organization. This inventory should include cloud services like AWS or Azure (IaaS), Heroku or Google App Engine (PaaS), Microsoft 365 or Salesforce (SaaS), as well as any third-party APIs and externally hosted applications your systems interact with.
An acceptable deliverable would be a documented inventory spreadsheet or database that includes details such as service name, provider, purpose, data classification, business owner, technical owner, contract renewal dates, and security assessment status for each external service.
Implementation Example
Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services
ID: ID.AM-04.129
Context
- Function
- ID: IDENTIFY
- Category
- ID.AM: Asset Management
- Sub-Category
- Inventories of services provided by suppliers are maintained
Related questions
- Does your organization maintain comprehensive inventories of all hardware assets, including IT equipment, IoT devices, operational technology (OT), and mobile devices?
- Does your organization implement automated network monitoring to detect new hardware and update inventory records in real-time?
- Does your organization maintain a comprehensive inventory of all software and services, including commercial, open-source, custom, API, and cloud-based applications?
- Does your organization implement continuous monitoring for software and service inventory changes across all platforms, including containers and virtual machines?
- Does your organization maintain a comprehensive inventory of all systems within your environment?
- Does your organization maintain documented baselines of expected network communication patterns and data flows for both wired and wireless networks?