All internal and external services the company depends on are formally required to be recorded
Recording every service the business depends on, with owner and criticality, gives supplier risk management something concrete to act on rather than an unlisted set of relationships.
This policy control requires every service the business depends on to be recorded with owner and criticality, extending A.5.9's inventory scope beyond hardware and software to services.
https://sekit.ai/api/mcp/crosswalk