# External Service Review

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/external-service-review/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** Use one review for each external system service: a cloud platform, software as a service, hosting, managed security or other service the system relies on but does not run. Complete it before the contract is awarded or the service is first used, then again at each annual review and whenever a trigger in section 7 occurs. NIST's SA-9 discussion keeps the responsibility for the risk of external services with the authorizing official, and has the organization document the basis of its trust in each provider so the relationship can be monitored; this review is that record. The contract terms themselves come from the [acquisition security requirements](https://kston83.github.io/nist-guide/templates/standards/acquisition-security-requirements/) (SA-4), and a connection or data exchange with the service also needs an [information exchange agreement](https://kston83.github.io/nist-guide/templates/forms/information-exchange-agreement/) (CA-3) or the same terms in the contract. The register at the end lists every external service and when it is next reviewed.

| Review ID | Review type | Review date | Reviewer | Next review due |
| --- | --- | --- | --- | --- |
| [Fill in: unique ID, as in the register] | [Fill in: initial (before use), annual, or triggered, with the trigger] | [Fill in: date] | [Fill in: name and title] | [Fill in: date] |

## 1. Service and provider

| Item | Description |
| --- | --- |
| Service name and edition | [Fill in: the service, and the edition or tier actually used] |
| Provider | [Fill in: organization, and any sub-service providers the service relies on, such as the hosting platform] |
| Service type | [Fill in: infrastructure, platform or software as a service; hosting; managed security; other outsourced operation] |
| Systems that rely on it | [Fill in: system names and identifiers] |
| Business purpose | [Fill in: why the organization uses the service] |
| Contract or agreement | [Fill in: contract number, term and end date, or the online terms accepted and their date] |
| Information and impact level | [Fill in: each type of information the service processes, stores or transmits, with its impact level] |
| Personally identifiable information | [Fill in: the types involved, or "none"] |
| Data location | [Fill in: countries or regions where data is stored and processed, including backups and support access] |
| Connection to the system | [Fill in: how the system connects, and the information exchange agreement ID, or "no connection"] |
| Service owner | [Fill in: name and title of the person who manages the relationship] |

## 2. Security and privacy requirements in the contract

This section confirms the contract or service agreement states the organization's requirements before the service is used.

- The provider shall comply with the organization's security and privacy requirements and employ [Fill in: controls to be employed by external system service providers. Typical: the controls of the system's baseline that the provider is responsible for, per the shared responsibility matrix, with evidence from an independent attestation]. (SA-9a)

| Requirement | In the contract (yes, no or not applicable) | Where | Notes |
| --- | --- | --- | --- |
| Controls the provider implements, and the baseline or framework they meet | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Independent attestation provided, and how often | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Security incident and breach notification, with the time | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Notice of significant changes to the service, its sub-service providers or its data locations | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Functions, ports, protocols and services the service needs, identified by the provider | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Privacy requirements, such as use limits and breach notification | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Data location limits | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Availability, backup and recovery commitments | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Right to assess, or access to evidence on request | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Return and deletion of the organization's data when the service ends | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |
| Requirements flowed down to the provider's subcontractors | [Fill in: answer] | [Fill in: clause] | [Fill in: notes] |

- The reviewer shall record each requirement that is missing, and the service shall not be used until it is added or the risk is accepted in section 6. (SA-9a)

## 3. Evidence of the provider's compliance

| Item | Description |
| --- | --- |
| Evidence type | [Fill in: for example an independent service auditor's report on controls, a certification against a security standard, a government authorization, or the organization's own assessment] |
| Issued by | [Fill in: the independent assessor or authorizing body] |
| Period or date covered | [Fill in: start and end dates, or the certificate's validity] |
| Scope matches the service used | [Fill in: yes, or what is outside the scope] |
| Result | [Fill in: for example an unqualified opinion, or the qualifications and exceptions] |
| Sub-service providers included or carved out | [Fill in: list] |

Exceptions and customer controls:

| Item from the evidence | Type | Effect on the system | Action | Tracked in |
| --- | --- | --- | --- | --- |
| [Fill in: exception, or customer control the report expects the organization to operate] | [Fill in: exception or customer control] | [Fill in: effect] | [Fill in: what the organization does about it] | [Fill in: POA&M item, system security plan section, or "none needed"] |

- The reviewer shall confirm the evidence is current and covers the service actually used. (SA-9c)
- The reviewer shall follow up each exception in the evidence, and each customer control the evidence expects the organization to operate, and record weaknesses that affect the system in its plan of action and milestones. (SA-9c, CA-5)

## 4. Shared responsibilities

| Control or area | Provider | [Organization name] | Shared | Where recorded in the system security plan |
| --- | --- | --- | --- | --- |
| [Fill in: for example account management, logging, encryption, backup, vulnerability remediation] | [Fill in: what the provider does] | [Fill in: what the organization does] | [Fill in: yes or no] | [Fill in: section] |

Oversight and user roles:

| Role | Who | Responsibilities for this service |
| --- | --- | --- |
| Service owner | [Fill in: name and title] | [Fill in: for example managing the contract, receiving the provider's reports and notices] |
| Security oversight | [Fill in: name and title] | [Fill in: for example this review, and reviewing the provider's evidence each year] |
| Administrators | [Fill in: team] | [Fill in: for example configuring the organization's settings and accounts in the service] |
| Users | [Fill in: group] | [Fill in: for example using the service only for the approved purpose and information] |

- The [System owner] shall record the oversight roles, the user roles and the shared responsibility matrix for the service, and show each control in the system security plan as inherited, shared or system-owned. (SA-9b)

## 5. Functions, ports, protocols and services

This section applies to [Fill in: external system services that require the identification of functions, ports, protocols, and other services. Typical: all external system services that connect to the system].

| Function or service | Port and protocol | Direction | Allowed under the organization's list (CM-7) | Boundary rule (SC-7) |
| --- | --- | --- | --- | --- |
| [Fill in: function] | [Fill in: port and protocol] | [Fill in: inbound or outbound] | [Fill in: yes, or the exception] | [Fill in: rule reference] |

- The [System owner] shall require the provider to identify the functions, ports, protocols and other services required for the use of the service, and record the list in the system security plan. (SA-9(2))
- The reviewer shall check the list against the organization's prohibited and restricted functions, ports, protocols and services before the service is used. (SA-9(2))

## 6. Risks and decision

| Risk or weakness | Rating | Response | Tracked in |
| --- | --- | --- | --- |
| [Fill in: risk] | [Fill in: rating] | [Fill in: mitigate, accept, transfer or avoid, with the measures] | [Fill in: risk register or POA&M item] |

Decision: [Fill in: approved for use; approved with conditions, listed below; or not approved].

Conditions: [Fill in: conditions, or "none"].

- A risk that remains after the review shall be accepted by the authorizing official for each system that relies on the service, before the service is used. (SA-9)

## 7. Ongoing monitoring

- The [System owner] shall employ [Fill in: processes, methods, and techniques employed to monitor control compliance by external service providers. Typical: annual review of independent attestation reports, review of the provider's continuous monitoring or status reports, and contract service reviews] to monitor the provider's control compliance on an ongoing basis. (SA-9c)
- The [System owner] shall repeat this review at least annually, when new evidence from the provider arrives, and when any of these occurs: a security incident or breach at the provider that affects the service, a significant change to the service or its sub-service providers, new evidence with exceptions, a change in the information the organization puts in the service or its impact level, or a contract renewal. (SA-9c)

| Monitoring activity | Frequency | Who | Last done |
| --- | --- | --- | --- |
| Review of the provider's independent attestation | [Fill in: for example each year, when the new report is issued] | [Fill in: role] | [Fill in: date] |
| Review of the provider's status or continuous monitoring reports | [Fill in: for example monthly or as they arrive] | [Fill in: role] | [Fill in: date] |
| Contract service review | [Fill in: for example quarterly] | [Fill in: role] | [Fill in: date] |
| Check of the provider's security notices and advisories | [Fill in: for example as they arrive] | [Fill in: role] | [Fill in: date] |

## 8. Approval

| Name | Role | Decision or recommendation | Signature | Date |
| --- | --- | --- | --- | --- |
| [Fill in: name] | Reviewer, security team | [Fill in: recommendation] | | [Fill in: date] |
| [Fill in: name] | System owner | [Fill in: recommendation] | | [Fill in: date] |
| [Fill in: name] | Authorizing official | [Fill in: decision, and risk acceptance where section 6 needs it] | | [Fill in: date] |

### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.j(2)(a) and (b), requires agencies to provide oversight of information systems used or operated by contractors or other entities on behalf of the Federal Government, including documented oversight policies and procedures, and to ensure that the security and privacy controls of those systems and services are effectively implemented and comply with NIST standards and guidelines and agency requirements. Under [OMB M-24-15](https://www.fedramp.gov/2026/authority/m-24-15/), Modernizing the Federal Risk and Authorization Management Program (July 25, 2024), agencies must obtain and maintain a FedRAMP authorization for cloud products and services that create, collect, process, store or maintain Federal information on the agency's behalf, unless the memo places them out of scope; agencies use the FedRAMP authorization package to issue their own authorization to operate or use (footnote 7). The assessment of security controls and materials in a FedRAMP authorization package is presumed adequate for use in an agency authorization to operate, which does not alter the agency's own responsibility for compliance or its authority to require more where it has a demonstrable need ([44 U.S.C. § 3613(e)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3613&num=0&edition=prelim)). As of September 2026.

- For a cloud product or service within the scope of OMB M-24-15, the reviewer shall record its FedRAMP authorization and impact level in section 3, and the service shall not process Federal information without one. (SA-9a)
- The authorizing official shall issue the agency's own authorization to use a FedRAMP-authorized service, relying on the FedRAMP package's assessment as 44 U.S.C. § 3613(e) provides, and recording any agency-specific requirements beyond it with the demonstrable need for them. (SA-9)
- For a system a contractor or other entity operates on the agency's behalf, the [System owner] shall record in this review how the agency oversees it and verifies that its controls are effectively implemented, as OMB Circular A-130, Appendix I, section 4.j(2), requires. (SA-9c)

## Register

| Review ID | Service | Provider | Systems that rely on it | Service type | Information and impact level | Evidence type and period end | Last review | Decision | Open exceptions | Next review due | Service owner |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: service] | [Fill in: provider] | [Fill in: systems] | [Fill in: type] | [Fill in: information and impact level] | [Fill in: evidence and date] | [Fill in: date] | [Fill in: approved, approved with conditions, or not approved] | [Fill in: number, with POA&M items] | [Fill in: date] | [Fill in: name] |