Selection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source data

Third parties should be selected according to an organized and thorough process and according to explicit specifications and selection criteria. The selection process and criteria should be designed to ensure that the selected entity can fully meet the organization’s specifications as established. For higher priority assets, these criteria should include the evaluation of associated third-party hosting environments and source data. Hosting environments and source data can be significant sources of acquired risk. Hosting environments comprise many layers of products and services that are not always under the direct control of hosting providers and may pose unidentified risk to the organization. For example, these may include software packages, open-source code libraries, configurations, and other settings that were used to build a virtual machine that can be deployed in a cloud environment. Similar to a bill of materials, hosting environments should provide documentation of the use of these products and services so that an approximation of acquired risk can be established. In addition, this concept can extend to how hosting organizations store, process, and transmit organizational data. Evaluating the storage locations of data, where it is processed, how it is transmitted, and the controls employed is essential for identifying potential risks to the confidentiality, integrity, and availability of such data.

Related Practices · Input From: Implementing ASSET-1c provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2b, THIRD-PARTIES-2i, THIRD-PARTIES-2j, THIRD-PARTIES-2k, THIRD-PARTIES-2l, THIRD-PARTIES-2m.