Solution 3 of 6
Turn legal, contractual and standards duties into controls that work, and keep the proof ready for the day someone asks.
The problem
Verizon’s 2026 report found third-party involvement in 48% of breaches, up 60% on last year’s dataset. Only 23% of third-party organizations fully fixed missing or improperly secured multifactor authentication on cloud accounts. Only 26% of critical vulnerabilities were fully fixed in 2025, down from 38%.
Duties arrive from several places: laws, contracts, customers and standards. Each uses its own words and asks for its own evidence. Teams often answer each one separately, so the same control is tested three times and nobody can say which duties it covers. Standards also move. PCI DSS v4.0 was retired on 31 December 2024, and its future-dated requirements took effect on 31 March 2025.
What an assessor, a regulator or a customer wants to see is evidence that a control works, and works at the suppliers you rely on.
Third-party cloud MFA findings, Verizon 2026
The three figures use different bases: a count of exposures, a share of findings, and a share of organizations. All are from Verizon’s 2026 report, which does not define “third-party organizations” in its executive summary.
Common mistakes
An audit tests controls against a defined scope and period. It says little about what sits outside that scope or what changes after it. Verizon’s 2026 data show how far day-to-day practice can sit from the target: only 26% of critical vulnerabilities were fully fixed in 2025, down from 38%.
A certificate or report covers the scope that was assessed, on the date it was assessed. It does not tell you whether the service you use is inside that scope. Verizon found third parties in 48% of breaches, and only 23% of third-party organizations fully fixed a basic cloud MFA gap.
Standards are revised and old versions are retired. ISO/IEC 27001:2013 certificates expired on 31 October 2025 unless moved to the 2022 edition. PCI DSS v4.0 was retired on 31 December 2024. A duty register needs an owner who watches for these changes.
Regional view
The UAE’s federal personal data protection law is Federal Decree-Law No. 45 of 2021, issued on 20 September 2021 and in force from 2 January 2022. The UAE Government portal says it covers processing of personal data inside and outside the UAE, and that a UAE Data Office acts as the federal regulator. The portal also lists DIFC Law No. 5 of 2020 on data protection. Which rules apply to an organization is a question for its counsel. We work from that answer.
Average cost of a data breach by how long it lasted, global, 2026. IBM. The two 200-day splits are as reported by Baker Donelson, quoting IBM.
Standards we work from
Using a standard as a common language is not certification or endorsement.
How it works
| Duty | Source | Owner | Control | Evidence |
|---|---|---|---|---|
| Report incidents on time | Regulator | Legal | C-14 | Current |
| Control access to personal data | Law | Data office | C-07 | Current |
| Assess key suppliers | Customer contract | Procurement | C-21 | Stale |
| Test backups yearly | Standard | IT ops | C-18 | Missing |
| Log admin activity | Standard | Security | C-09 | Current |
We list the duties that apply to you, from laws, contracts, customers and chosen standards. Your counsel decides what each law means for you. We turn each duty into a plain statement of what must be true and what would prove it.
| Item | Law | Standard | Customer | Insurer |
|---|---|---|---|---|
| C-07 Access control | ||||
| C-09 Admin logging | ||||
| C-14 Incident process | ||||
| C-18 Backup testing | ||||
| C-21 Supplier checks |
Answers the dutyPartlyNo link
We test your controls against that register, then design what is missing. One control can answer several duties, so we map it once and test it once. The people who run the systems own the fixes.
Rehearsal found two documents that could not be produced in a day.
We check that evidence exists, is current and is easy to produce, then rehearse the audit or regulator request. We watch for changes in rules and suppliers. Certificates and attestation reports come from accredited bodies and licensed auditors, not from us.
Where this starts
Choose a question4 questions · select any
What you hold
| Supplier | Touches | Assurance held | Reviewed |
|---|---|---|---|
| Payroll provider | Employee data | Audit report | 3 months ago |
| Cloud host | Everything | Audit report | 5 months ago |
| Support tool | Customer data | Questionnaire only | 14 months ago |
| Marketing agency | Contact lists | Nothing held | Never |
| Print vendor | Letters | Contract terms | 8 months ago |
Each duty, who owns it, the control that answers it and the evidence that proves it.
Who uses itCompliance, legal, risk
Where controls are missing, partial or not working, and which duties each gap touches.
Who uses itCISO, control owners
Controls to design or fix, with owner, effort and the duties each one covers.
Who uses itIT and engineering leads
The documents, logs and test results an assessor will ask for, kept current and easy to find.
Who uses itAudit and compliance teams
Suppliers sorted by what they touch, with the assurance you hold on each and the gaps.
Who uses itProcurement, CISO, CFO
A different way to look
Three lists, three owners. The same control is tested again for each.
| Item | Framework A | Framework B | Framework C | Customer |
|---|---|---|---|---|
| Access control | ||||
| Admin logging | ||||
| Incident process | ||||
| Backup testing |
Answers the dutyPartlyNo link
What leadership hears
We are compliant.→
Four controls cover most of our duties. Three are tested monthly. One supplier cannot show evidence.
Where our specialists come in
Your problem decides which of these we use. You do not have to pick.
Meet your obligations
Read first
Perspective
Passing an audit and being hard to breach are related goals, not the same goal. Knowing the gap shows where compliance spending helps security and where it does not.
Cybrilliant GRC SME
Read →Practitioner Field Note
Controls built per system or per regulation leave gaps between the steps of a process. Start with the process, find where it can fail, and place controls there.
Cybrilliant Security Controls SME
Read →Executive Briefing
A control that exists is not evidence of a control that works. Here is what leadership should ask for, and what regulators and standards expect it to be able to show.
Cybrilliant GRC SME
Read →Threat Intelligence
A supply-chain incident rarely breaks through your perimeter. It arrives through access you granted on purpose.
Cybrilliant Supply Chain Risk SME
Read →Expert Briefing
An executive discussion on turning third-party risk information into prioritization, governance and action.
Cybrilliant Supply Chain Risk SME
Read →Practitioner Field Note
Audit evidence should be a by-product of how controls run, not a scramble each time the audit window opens.
Cybrilliant GRC SME
Read →Questions
No. Cybrilliant is not counsel. Your legal team decides what a law or contract requires of you. We turn that reading into controls, tests and evidence, and we flag where a legal question needs an answer before we can proceed.
The ones you must meet or have chosen, such as ISO/IEC 27001, PCI DSS and the NIST Cybersecurity Framework 2.0. We use them as a common language and map each control once. We do not issue certificates or audit opinions.
Check that the certificate covers the 2022 edition and the scope you now run. Then check that other duties, such as customer contracts and sector rules, map to the same controls. A certificate is one piece of evidence, not the whole register.
We sort them by what they touch, such as data, access or critical services. We then match the assurance to that: contract terms, independent reports such as SOC reports, or direct testing. Not every supplier needs the same depth.
A short view: which duties are met, which are at risk, which suppliers carry the most exposure, and what is being fixed by whom. Each item is tied to a decision the board can take.
