CIS Control 15: how should a small firm manage service providers?

What does CIS Control 15 cover?

CIS Control 15 covers the outside companies that hold your sensitive data or run systems your firm depends on. The CIS Critical Security Controls v8.1 describe its purpose as developing "a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise's critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately."

For a professional services firm, that list is longer than most leaders expect. It includes the managed IT provider, the cloud email and file platform, the portfolio accounting or practice management system, the document management vendor, the e-signature tool, payroll, the backup service, and any AI tool staff have been allowed to use. Each one either holds client data or keeps the firm running, and a failure at any of them becomes your incident.

Control 15 has seven safeguards, and together they form a lightweight third-party risk management program. Version 8.1 maps five of them to the Govern security function, which signals a management discipline that leadership owns, with a technical edge.

Which Control 15 safeguards apply to a small firm?

Only one Control 15 safeguard is in Implementation Group 1: Safeguard 15.1, the service provider inventory. The rest phase in at higher Implementation Groups, which CIS sizes to a firm's resources and risk. The full breakdown from the CIS Controls v8.1 documentation:

• 15.1 Establish and maintain an inventory of service providers (IG1, IG2, IG3).
• 15.2 Establish and maintain a service provider management policy (IG2, IG3).
• 15.3 Classify service providers (IG2, IG3).
• 15.4 Ensure service provider contracts include security requirements (IG2, IG3).
• 15.5 Assess service providers (IG3).
• 15.6 Monitor service providers (IG3).
• 15.7 Securely decommission service providers (IG3).

A firm that handles regulated client data, such as an RIA, a broker-dealer or a CPA firm, will usually find that its regulators expect more than IG1. That is a reason to treat 15.2 through 15.4 as the realistic target, even for a small office. If you are still deciding which group fits, our explainer on CIS IG1 covers how the groups are built.

What goes in a service provider inventory?

Safeguard 15.1 asks for a list of all known service providers, with a classification and a named internal contact for each, reviewed annually or when the business changes significantly. That is the whole requirement, and it is achievable in an afternoon.

A useful inventory answers a few questions for each provider:

• What does the provider do for us, and which systems or data can it reach?
• Who at our firm owns the relationship and gets the call if something goes wrong?
• Does the provider hold client personal information, and roughly how much?
• Could we keep operating for a week if this provider went dark?
• When does the contract renew, and where is the signed copy?

Start from accounts payable and the list of applications connected to your Microsoft 365 or Google tenant. Between the two you will find most of your providers, including free tools that never generated an invoice but still have access to client files.

How should you classify providers and write security terms into contracts?

Classification tells you how much attention each provider deserves, and contracts make that attention enforceable. Safeguard 15.3 lists the characteristics to weigh: data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Most small firms get by with three tiers. Critical providers hold client data or run core operations. Important providers touch internal data or support functions you could work around for a while. Low-risk providers touch neither.

Safeguard 15.2 asks for a written policy that addresses classification, inventory, assessment, monitoring and decommissioning. It does not need to be long. One or two pages that say how a provider gets approved, who approves it, and what happens at renewal and exit will satisfy the intent.

Safeguard 15.4 is where the leverage sits. CIS gives example contract terms: minimum security program requirements, security incident and data breach notification and response, data encryption requirements, and data disposal commitments. It also asks firms to review contracts annually for missing security terms. Renewal season is the cheapest time to add them.

Do you need a SOC 2 report from every vendor?

No. Safeguard 15.5 says assessment scope "may vary based on classification(s)" and may include standardized reports such as SOC 2 or a PCI Attestation of Compliance, customized questionnaires, or "other appropriately rigorous processes." It is an IG3 safeguard, and it calls for reassessment annually at a minimum or with new and renewed contracts.

In practice, ask your critical providers for their SOC 2 Type II report and read the exceptions and the complementary user entity controls, which list the controls the provider expects you to run. For important providers, a short questionnaire or a review of the provider's published security documentation is usually proportionate. Low-risk providers may need nothing beyond an entry in the inventory.

Safeguard 15.6 extends this into monitoring between assessments. CIS mentions periodic reassessment, monitoring provider release notes, and dark web monitoring. For a small firm, the realistic version is watching for breach disclosures and major changes, such as new AI features, at your critical providers.

What happens when you leave a provider?

Safeguard 15.7 covers exit. CIS lists user and service account deactivation, termination of data flows, and secure disposal of enterprise data within the provider's systems. Exits are a common place for data to be left behind: an old file share nobody closed, an integration still syncing contacts, or an admin account for a vendor that was replaced two years ago.

Treat every exit like an employee offboarding. Disable the accounts, revoke API tokens and app consents, export what you must retain under your recordkeeping rules, and get written confirmation of deletion for the rest. Then update the inventory.

How does Control 15 line up with Reg S-P and the FTC Safeguards Rule?

For financial services firms, Control 15 is a practical way to organize duties that already exist in regulation. Under the amended Regulation S-P, 17 CFR 248.30(a)(5), a covered institution's incident response program must include policies and procedures for overseeing service providers, including due diligence and monitoring, so that providers protect customer information and notify the firm as soon as possible and no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. The FTC Safeguards Rule, 16 CFR 314.4(f), requires covered financial institutions to select capable service providers, require safeguards by contract, and periodically assess them.

Neither rule mentions CIS. They describe outcomes, and Control 15's inventory, classification, contract terms and assessments are a recognizable way to produce the evidence an examiner asks for. We cover the contract side in more depth in Reg S-P service provider notice and the ongoing side in vendor oversight under GLBA. Firms using NIST CSF 2.0 will find the same ideas in the GV.SC category.

What should a small firm do about Control 15 this quarter?

A small firm can reach a defensible Control 15 position in one quarter:

• Build the inventory from accounts payable and connected app lists, with an owner for each provider.
• Tier every provider as critical, important or low risk, and note why.
• Write a one-page provider policy covering approval, contract review, assessment and exit.
• For each critical provider, collect the current SOC 2 report or a completed questionnaire and file it with the contract.
• Flag contracts that renew in the next twelve months and lack breach notification, encryption or disposal terms.
• Close out any provider you no longer use, and confirm in writing that your data was deleted.

How does s90 help with service provider management?

s90 maintains the provider inventory and connected app review as part of our CIS Controls and compliance programs, and we hold ourselves to the same standard we ask of your other vendors: our agreements commit to notifying clients within 72 hours of a breach and producing evidence within 24 hours of a request. If you would like a second set of eyes on your vendor list before your next exam or renewal cycle, we are happy to talk it through.