External Service Review template: The review of one external system service before the organization uses it and at each review after that, covering the contract's security and privacy requirements, the provider's evidence of compliance, the shared responsibilities and the decision, with a register of every external service and its next review, as SP 800-53 SA-9 requires.
The review of one external system service before the organization uses it and at each review after that, covering the contract’s security and privacy requirements, the provider’s evidence of compliance, the shared responsibilities and the decision, with a register of every external service and its next review, as SP 800-53 SA-9 requires.
This section confirms the contract or service agreement states the organization’s requirements before the service is used.
The provider shall comply with the organization’s security and privacy requirements and employ Fill in: controls to be employed by external system service providers Typical: the controls of the system’s baseline that the provider is responsible for, per the shared responsibility matrix, with evidence from an independent attestation. (SA-9a)
Requirement
In the contract (yes, no or not applicable)
Where
Notes
Controls the provider implements, and the baseline or framework they meet
Fill in: answer
Fill in: clause
Fill in: notes
Independent attestation provided, and how often
Fill in: answer
Fill in: clause
Fill in: notes
Security incident and breach notification, with the time
Fill in: answer
Fill in: clause
Fill in: notes
Notice of significant changes to the service, its sub-service providers or its data locations
Fill in: answer
Fill in: clause
Fill in: notes
Functions, ports, protocols and services the service needs, identified by the provider
Fill in: answer
Fill in: clause
Fill in: notes
Privacy requirements, such as use limits and breach notification
Fill in: answer
Fill in: clause
Fill in: notes
Data location limits
Fill in: answer
Fill in: clause
Fill in: notes
Availability, backup and recovery commitments
Fill in: answer
Fill in: clause
Fill in: notes
Right to assess, or access to evidence on request
Fill in: answer
Fill in: clause
Fill in: notes
Return and deletion of the organization’s data when the service ends
Fill in: answer
Fill in: clause
Fill in: notes
Requirements flowed down to the provider’s subcontractors
Fill in: answer
Fill in: clause
Fill in: notes
The reviewer shall record each requirement that is missing, and the service shall not be used until it is added or the risk is accepted in section 6. (SA-9a)
Fill in: for example an independent service auditor’s report on controls, a certification against a security standard, a government authorization, or the organization’s own assessment
Issued by
Fill in: the independent assessor or authorizing body
Period or date covered
Fill in: start and end dates, or the certificate’s validity
Scope matches the service used
Fill in: yes, or what is outside the scope
Result
Fill in: for example an unqualified opinion, or the qualifications and exceptions
Sub-service providers included or carved out
Fill in: list
Exceptions and customer controls:
Item from the evidence
Type
Effect on the system
Action
Tracked in
Fill in: exception, or customer control the report expects the organization to operate
Fill in: exception or customer control
Fill in: effect
Fill in: what the organization does about it
Fill in: POA&M item, system security plan section, or “none needed”
The reviewer shall confirm the evidence is current and covers the service actually used. (SA-9c)
The reviewer shall follow up each exception in the evidence, and each customer control the evidence expects the organization to operate, and record weaknesses that affect the system in its plan of action and milestones. (SA-9c, CA-5)
Fill in: for example account management, logging, encryption, backup, vulnerability remediation
Fill in: what the provider does
Fill in: what the organization does
Fill in: yes or no
Fill in: section
Oversight and user roles:
Role
Who
Responsibilities for this service
Service owner
Fill in: name and title
Fill in: for example managing the contract, receiving the provider’s reports and notices
Security oversight
Fill in: name and title
Fill in: for example this review, and reviewing the provider’s evidence each year
Administrators
Fill in: team
Fill in: for example configuring the organization’s settings and accounts in the service
Users
Fill in: group
Fill in: for example using the service only for the approved purpose and information
The System owner shall record the oversight roles, the user roles and the shared responsibility matrix for the service, and show each control in the system security plan as inherited, shared or system-owned. (SA-9b)
This section applies to Fill in: external system services that require the identification of functions, ports, protocols, and other services Typical: all external system services that connect to the system.
Function or service
Port and protocol
Direction
Allowed under the organization’s list (CM-7)
Boundary rule (SC-7)
Fill in: function
Fill in: port and protocol
Fill in: inbound or outbound
Fill in: yes, or the exception
Fill in: rule reference
The System owner shall require the provider to identify the functions, ports, protocols and other services required for the use of the service, and record the list in the system security plan. (SA-9(2))
The reviewer shall check the list against the organization’s prohibited and restricted functions, ports, protocols and services before the service is used. (SA-9(2))
Fill in: mitigate, accept, transfer or avoid, with the measures
Fill in: risk register or POA&M item
Decision: Fill in: approved for use; approved with conditions, listed below; or not approved.
Conditions: Fill in: conditions, or “none”.
A risk that remains after the review shall be accepted by the authorizing official for each system that relies on the service, before the service is used. (SA-9)
The System owner shall employ Fill in: processes, methods, and techniques employed to monitor control compliance by external service providers Typical: annual review of independent attestation reports, review of the provider’s continuous monitoring or status reports, and contract service reviews to monitor the provider’s control compliance on an ongoing basis. (SA-9c)
The System owner shall repeat this review at least annually, when new evidence from the provider arrives, and when any of these occurs: a security incident or breach at the provider that affects the service, a significant change to the service or its sub-service providers, new evidence with exceptions, a change in the information the organization puts in the service or its impact level, or a contract renewal. (SA-9c)
Monitoring activity
Frequency
Who
Last done
Review of the provider’s independent attestation
Fill in: for example each year, when the new report is issued
Fill in: role
Fill in: date
Review of the provider’s status or continuous monitoring reports
Fill in: for example monthly or as they arrive
Fill in: role
Fill in: date
Contract service review
Fill in: for example quarterly
Fill in: role
Fill in: date
Check of the provider’s security notices and advisories
OMB Circular A-130, Appendix I, section 4.j(2)(a) and (b), requires agencies to provide oversight of information systems used or operated by contractors or other entities on behalf of the Federal Government, including documented oversight policies and procedures, and to ensure that the security and privacy controls of those systems and services are effectively implemented and comply with NIST standards and guidelines and agency requirements. Under OMB M-24-15, Modernizing the Federal Risk and Authorization Management Program (July 25, 2024), agencies must obtain and maintain a FedRAMP authorization for cloud products and services that create, collect, process, store or maintain Federal information on the agency’s behalf, unless the memo places them out of scope; agencies use the FedRAMP authorization package to issue their own authorization to operate or use (footnote 7). The assessment of security controls and materials in a FedRAMP authorization package is presumed adequate for use in an agency authorization to operate, which does not alter the agency’s own responsibility for compliance or its authority to require more where it has a demonstrable need (44 U.S.C. § 3613(e)). As of September 2026.
For a cloud product or service within the scope of OMB M-24-15, the reviewer shall record its FedRAMP authorization and impact level in section 3, and the service shall not process Federal information without one. (SA-9a)
The authorizing official shall issue the agency’s own authorization to use a FedRAMP-authorized service, relying on the FedRAMP package’s assessment as 44 U.S.C. § 3613(e) provides, and recording any agency-specific requirements beyond it with the demonstrable need for them. (SA-9)
For a system a contractor or other entity operates on the agency’s behalf, the System owner shall record in this review how the agency oversees it and verifies that its controls are effectively implemented, as OMB Circular A-130, Appendix I, section 4.j(2), requires. (SA-9c)
Fill in: approved, approved with conditions, or not approved
Fill in: number, with POA&M items
Fill in: date
Fill in: name
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.