The ability to demand the implementation and management of security controls on third parties providing services to an organization is

Vendor management, also known as third-party risk management (TPRM), is the specific discipline responsible for overseeing relationships with external service providers. A critical function of this process is to ensure that vendors and suppliers adhere to the organization's security requirements. This is accomplished through contractual agreements, security assessments, audits, and ongoing monitoring. The ability to demand and enforce security controls on these third parties is a direct outcome of a mature vendor management program, which aims to mitigate the risks introduced by relying on external entities for business functions.

A. Security Governance is the overarching framework of policies and processes; vendor management is a specific component within that framework.
B. Compliance management focuses on adhering to laws and regulations, which may drive vendor requirements but is not the process of managing the vendors itself.
D. Disaster recovery is a specific set of controls and plans for business continuity, not the process of managing third-party security obligations.

1. NIST Special Publication 800-161, Revision 1. (2022). Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. National Institute of Standards and Technology. (Section 2.1, "Foundational Practices," outlines the need to establish and manage cybersecurity requirements for suppliers).

2. Carnegie Mellon University, Software Engineering Institute. (2010). A Framework for Measuring and Managing Information Security in the Supply Chain. (CMU/SEI-2010-TN-019). (This report details the processes for managing security risks within the supply chain, which is synonymous with vendor management).

3. Hall, T., & Hylender, C. D. (2017). Information security governance in a Swedish public agency. Information & Computer Security, 25(1), 101-117. (Discusses how governance extends to external parties, identifying this as a key management challenge). DOI: https://doi.org/10.1108/ICS-05-2016-0041