Does your organization update its external service inventory when a new third-party service is adopted to ensure proper cybersecurity risk monitoring?

Maintaining an updated inventory of external services is crucial for tracking third-party risk exposure and ensuring appropriate security monitoring is in place. When new cloud services, SaaS applications, or other external dependencies are adopted, they introduce potential security vulnerabilities that must be identified and managed. Evidence could include a documented process for updating the external service inventory, screenshots of the inventory management system showing recent additions, or change management records that demonstrate the inventory was updated when new services were onboarded.