This requirement exists to assess, monitor, plan for, report on, review, and improve resilience of critical third parties and supply-chain dependencies, with specific focus on third-party resilience monitoring, so that critical services remain resilient against disruption and decisions are accountable and traceable.
Establish and document the process for third-party resilience monitoring. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently to critical services and their dependencies, and integrate it with risk management, business continuity, incident management, technology operations, and third-party management where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.02 – Maintain business resilience. 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.01 – Define the business continuity policy, objectives and scope. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 28(1) – General principles for ICT third-party risk management Article 29 – Preliminary assessment of ICT concentration risk at entity level |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 28(1) – Processor requirements; Article 32(2) – Risk-based security measures |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(b)(1)-(3) Business associate contracts and other arrangements |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.14-3.1 – Vendor IS classification; §2.14-3.4 – Periodic assessment |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 4.2.1 – General; 6.1.1 – Determining risks and opportunities; 8.3.4 – Resource requirements |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.1 – Monitoring, measurement, analysis and evaluation |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.22 – Monitoring, review and change management of supplier services |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(d) – Supply chain security, including relationships with direct suppliers/service providers Article 21(3) – Supplier vulnerabilities, product/cybersecurity quality and secure development; critical supply-chain risk assessment results |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.IR – Technology Infrastructure Resilience | PR.IR-03 – Mechanisms are implemented to achieve resilience requirements in normal and adverse situations |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT, 3.6 – CONTINGENCY PLANNING; PM-9 – RISK MANAGEMENT STRATEGY, CP-2 – CONTINGENCY PLAN |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Infrastructure – Resilience |
India
Standard
|
vLatest | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.8.3 – An established process is implemented for; 12.8.4 – A program is implemented to monitor TPSPs’; 12.8.5 – Information is maintained about which PCI |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 11) Vendor Risk Management – 11.1 Accountability for security risks in outsourced and partner arrangements; 11) Vendor Risk Management – 11.3 Due diligence, oversight and management of third-party vendors/service providers/partners; 19) Incident Response & Management – 19.5 Resilience capabilities and coordinated testing across interconnected systems, vendors and partners |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. CC7.2 – System Operations – The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. |
AICPA
Audit Framework
|
vLatest | View → |