Law / Frameworks / NIST CSF 2.0 / Detect
NIST CSF 2.0, DetectDE.CM-06
External service provider activities and services are monitored to find potentially adverse eventsNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), DE.CM-06
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 2
- laws
- 2
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Sector security regimes
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Canada |
OSFI Guideline B-10, Third-Party Risk Management |
Monitor third-party arrangements to verify that the third party can keep meeting its obligations and managing risks, and keep documented processes with the third party to identify, investigate, escalate, track and remediate incidents. |
 New York |
DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment |
The Department says you should consider enhancing monitoring and validation of the expected behavior of third-party code, applications, permissions and practices, and engaging with critical third-party service providers to confirm awareness of heightened cybersecurity risks and readiness to respond to potential disruptions. |
Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.