Third-Party Assessment
What is Third-Party Assessment?
An evaluation of a vendor or partner's security posture, compliance status, and risk profile conducted as part of vendor management.
Terms that appear alongside third-party assessment
Each of these is named in at least one of the same controls as third-party assessment. The number is how many controls name both.
- audit 5 shared controls
- nist 4 shared controls
- cybersecurity 4 shared controls
- integrity 3 shared controls
- baseline 3 shared controls
- fedramp 3 shared controls
- certification 3 shared controls
- authorization 3 shared controls
Frameworks that govern third-party assessment
What the standards actually require on third-party assessment
Requirements naming third-party assessment across 6 standards, quoted from the control text.
The company must permit an independent assessment by a third party of its supply chain due diligence activities and processes, be prepared with relevant documentation samples, and give assessors access to sites, personnel and all relevant records;
responsible-minerals-initiative-rmi-responsible-minerals-assurance-process::A-4 · All Minerals Step 4: independent third-party assessment →C-STAR is a third-party assessment for the Greater China market that harmonises CSA practice with Chinese national standards: it uses the GB/T 22080-2008 management system standard with the CCM plus 29 related controls selected from GB/T 22239-2008 and GB/Z 28...
csa-star-security-trust-assurance-and-risk::L2-CSTAR · Meet the C-STAR requirements for the Greater China market →Operate security test + certification + conformance per O-RAN WG11 Security Test Specifications and WG11 Test Specifications including Open Test and Integration Center (OTIC) testing.
ORANWG11-6 · Security Test Specifications, Certification, and Conformance →Every stakeholder who needs it receives timely information on where I&T-related exposures and opportunities currently stand, so that they can respond appropriately.
cobit-2019::APO12.04 · APO12.04 Articulate risk →Service agreements must contain, as a minimum, agreed terms on: the scope, nature and location of the relationship and services; security requirements including the shared responsibility split; change management; logging and monitoring;
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::STA-11 · Primary Service and Contractual Agreement →Article 17(4) of the RED provides that where the harmonised standards have not been applied, or have been applied only in part, for the Article 3(2) or Article 3(3) essential requirements, the manufacturer must use EU-type examination followed by conformity to...
eu-delegated-regulation-eu-2022-30-radio-equipment-cybersecurity::4.3 · Notified body route where the harmonised standards are not applied in full or a restriction bites →Questions people ask about third-party assessment
What is Third-Party Assessment?
Why is Third-Party Assessment important for compliance?
Which compliance frameworks address Third-Party Assessment?
Where can I learn more about Third-Party Assessment?
See how Third-Party Assessment applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.