--- title: Service Provider Management Advisory | Zanarc description: Free Zanarc advisory on service provider cybersecurity due diligence and ongoing monitoring, with five breach case studies and an Excel toolkit. 38 pages, September 2026. image: https://resources.zanarc.com/hubfs/Zanarc_Advisory_Service_Provider_Management_Social_1200x628.png --- [![Zanarc Limited](https://resources.zanarc.com/hs-fs/hubfs/Zanarc%20Logo_Lockup_Landscape_Colour_RGB.png?width=250&height=33&name=Zanarc%20Logo_Lockup_Landscape_Colour_RGB.png "Zanarc Limited")](https://zanarc.com) Advisory · 16 September 2026 # Service provider management **Cybersecurity due diligence and ongoing monitoring.** A service provider can expose an organisation to attack through the systems it operates, the information it holds and the authority it has been given. That authority may include administering infrastructure, distributing software, preparing transactions, handling support requests or sending messages that customers recognise as legitimate. A provider does not need access to production systems or cryptographic key material to create a serious security risk. Zanarc’s Service Provider Management Advisory explains how to assess these risks before approving a provider, examine the relevant security controls and monitor the service throughout the relationship. It draws on five breach case studies (Bybit and Safe, Brevo, SolarWinds, Target and CalPERS) and sets out six evidence priorities for critical services, a due diligence method, a monitoring schedule and the response criteria to apply when a provider is compromised. The advisory is delivered with the Zanarc Service Provider Management Toolkit, an Excel workbook containing a service register, exposure map, assessment record, evidence index, risk and action log, monitoring plan, review log, incident record and exit test. Boards, executives and security teams may also contact Zanarc to request a confidential briefing on selected findings from the research behind the advisory. Register your email address to download the advisory and the toolkit. ### Register to download ## What the advisory covers Written for boards, executives, procurement teams, security and technology teams, service owners and assurance professionals. Inside the advisory: ![Zanarc advisory: Service Provider Management, cybersecurity due diligence and ongoing monitoring. Advisory, 16 September 2026, 38 pages.](https://resources.zanarc.com/hs-fs/hubfs/Zanarc_Advisory_Service_Provider_Management_Cover_NoButton_1200x.png?width=372&height=496&name=Zanarc_Advisory_Service_Provider_Management_Cover_NoButton_1200x.png "Zanarc advisory: Service Provider Management, cybersecurity due diligence and ongoing monitoring. Advisory, 16 September 2026, 38 pages.") ### Six evidence priorities Service scope and responsibilities, important security controls, customer controls, incident response, recovery and exit, and approval and unresolved risks: what to assess before approval and during monitoring. ### Five breach case studies Bybit and Safe, Brevo, SolarWinds Orion, Target and CalPERS, each following one principal attack vector and identifying the evidence to check for comparable services. ### Due diligence and control priorities Finding the services in use, classifying them by the consequences of failure, writing risk scenarios, reading assurance reports critically, testing access revocation and recovery, and setting contractual conditions. ### Ongoing monitoring and response A monitoring schedule by criticality tier, response criteria for alerts and findings, management reporting on unresolved risks, and how to respond when a provider is compromised. ### Assurance and oversight What an independent review should establish, questions for boards and executives, and benchmarks from NIST CSF 2.0 and SP 800-161, ISO/IEC 27036, CIS Control 15 and DORA. ### The accompanying toolkit An Excel workbook with a service register, exposure map, assessment record, evidence index, risk and action log, monitoring plan, review log, incident record and exit test, plus practical checks that need no specialist software. ## Frequently asked questions About the advisory, the registration process, and Zanarc. Who is the advisory written for? Boards, executives, procurement teams, security and technology teams, service owners and assurance professionals. The advisory applies across sectors, with additional guidance for digital-asset platforms where a manipulated instruction can result in an irreversible transfer. Section 8 sets out the questions most relevant to boards and executives. Is the advisory free? Yes. Register your email address and your copy of the 38-page PDF and the accompanying Excel toolkit will be sent to your inbox. How will my email address be used? To deliver the advisory and toolkit and, where you have opted in, occasional updates from Zanarc on digital asset cybersecurity. You can unsubscribe at any time. What is in the toolkit? The Zanarc Service Provider Management Toolkit is a blank Excel workbook with a workbook guide, service register, exposure map, assessment record, evidence index, risk and action log, monitoring plan, review log, incident record, exit test and the six evidence priorities for critical services. The Overview sheet calculates counts and attention flags from the records. Keep sensitive evidence in a repository with restricted access and link to it from the workbook; assessment records should never contain passwords, API secrets or cryptographic key material. Does the advisory replace NIST, ISO/IEC or CIS guidance? No. The advisory draws on NIST CSF 2.0 and SP 800-161, ISO/IEC 27001 and ISO/IEC 27036, CIS Control 15, the UK NCSC supply chain guidance and DORA, and states where each applies. The assessment method, frequencies, thresholds and templates are Zanarc suggestions; any stricter obligation arising from legislation, a licence, a contract or an adopted standard takes precedence. Who is Zanarc? Zanarc is a specialist blockchain and digital asset cybersecurity consultancy. It advises virtual asset platforms and their supervisors, conducts CryptoCurrency Security Standard (CCSS) readiness assessments and audits, and assesses cybersecurity risks arising from artificial intelligence, real-world asset tokenisation, nested exchange arrangements and service provider relationships. # Register to download the advisory and toolkit A provider does not need access to production systems or cryptographic key material to create a serious security risk. The advisory sets out how to assess each provider according to the harm its access, information or influence could cause, and the toolkit records the evidence reviewed, the risks left unresolved and the authorised decision. Register to download [![Zanarc Logo\_Lockup\_Landscape\_Reverse\_White\_RGB](https://resources.zanarc.com/hs-fs/hubfs/Zanarc%20Logo_Lockup_Landscape_Reverse_White_RGB.png?width=300&height=40&name=Zanarc%20Logo_Lockup_Landscape_Reverse_White_RGB.png "Zanarc Logo_Lockup_Landscape_Reverse_White_RGB")](https://zanarc.com) © 2026 Zanarc. All rights reserved.