Supplier Terrain Register

Control Statement

Suppliers, integrators and managed-service providers with a path into the estate shall be registered on the terrain overlay, with the access each holds and the elements it reaches recorded.

Purpose. To make third parties positional, so that supplier risk is assessed against what a supplier can reach rather than against what they were contracted to do.

Discussion

Procurement already holds a vendor list; this is not that. The distinguishing requirement is *the elements it reaches* — a supplier with a narrow contract and broad technical access is the case this control exists to surface, and it is invisible on any acquisition record because the contract describes intent while the entitlement describes capability. Reconciling the register against provisioned access rather than against contracts is therefore the control's operative activity, and it routinely finds access that outlived the engagement that justified it.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Register every supplier, integrator and managed-service provider holding a path into the estate as an external actor on the overlay.
2. L2Record the access each holds and the elements that access reaches.
3. L2Raise a finding for suppliers holding unrecorded access.
4. L3Reconcile the register against provisioned access in the identity and network estate, not against the acquisition record, since contracts describe intent and entitlements describe capability.
5. L3Record reach transitively where a supplier's access permits movement beyond the element it terminates on.
6. L3Raise a finding for any supplier holding standing access to a decisive point (KT-1), and route it to LC-3 for constraint.
7. L3Reconcile against the SCRM scope under FO-6, so an access-holding supplier outside that scope is a recorded position rather than an oversight.
8. L4Trend the count of suppliers and the aggregate weight of elements they reach, since supplier reach expands quietly through renewals and scope changes.
9. L4Measure the interval between engagement end and access removal, which is the window in which reach exists with no contract behind it.
10. L5Feed reach findings into acquisition, so access scope is specified before award rather than discovered at the next reconciliation.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.