Govern · Established tier · Vendor Risk

GV-03Material outsourcing and cloud providers are assessed

Material service providers, cloud included, are assessed before engagement and on a cycle, with a right to audit and an exit plan.

Status

Evidence indicates

All 2 items support it and are fresh.

Exposure

Medium

2 evidence items from 1 sources

CCSA · Govern

Established

Not blocking this domain's next tier.

Evidence chain

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-gv03-1

All 38 material providers assessed on cycle, with a right to audit

ServiceNow ITSM · export · collected 27 h ago (Oct 14, 2026 · 12:02 UTC) · limit 30 days

Supports

Query: GET /api/now/table/u_vendor_assessment?sysparm_query=u_material=true
Identity: oauth app assurance-ro (table ACL: read)
Collector: servicenow-collector 2.0.3
Window: 24 h
Records: 38
SHA-256: 4027b18ca165bfdcd06fadcdbfafb9196c990fcc95a4bc8f58dd7600cb8f38fe

ev-gv03-2

Exit plans on file for all 5 material cloud services

ServiceNow ITSM · export · collected 27 h ago (Oct 14, 2026 · 12:02 UTC) · limit 30 days

Supports