Direct answer
Record each important provider, the service it supports, data or access involved, internal owner and responsibilities on both sides. Review changes and incidents through the organization's vendor management process.
Map the dependency
For a customer portal, list the identity provider, hosting platform, payment processor and email service. Record the business function and which environment uses each. A provider can be critical even when it is not directly visible to users.
Reference: NIST Cybersecurity Framework 2.0.
Identify access and data
Document the data categories, service accounts, integration privileges and support access involved. Keep secrets in approved storage rather than the inventory. Ask owners which layer the provider manages and which configuration remains the customer's responsibility.
- Name the internal service and contract owner.
- Record critical contacts and incident escalation routes.
- Track contracts, dependencies and review dates.
Review evidence and changes
Collect appropriate evidence under procurement and contractual arrangements, and note its date and scope. A vendor report may not cover your configuration or prove your application is secure. Reassess when the integration or the provider's service changes.
Reference: NIST Cybersecurity Framework 2.0.
Plan response
Agree how the organization will receive incident notices, restrict access and coordinate recovery. For testing, check current provider rules and obtain authorization for the specific assets and methods. Track unresolved vendor-dependent fixes with an internal owner.
Assessment limits
An inventory depends on complete input from business and technical owners. It does not independently verify a provider's controls or contractual compliance.
Frequently asked questions
Does using a cloud provider transfer all security responsibility?
No. Responsibilities differ by service; document the provider and customer obligations for each integration.
Can a provider's test report cover our configuration automatically?
Not necessarily. Read its scope and date, and assess the controls your organization configures.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.