Vendor and supply-chain risk: who requires what
Breaches through suppliers keep climbing the incident charts, and frameworks have followed. Most now require supplier security, but they mean different things by it.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Suppliers have become one of the most common routes into organisations, from compromised software updates to breached managed service providers. Frameworks have responded, some more than others. ControlMapping tracks this in two topics: vendor risk management (assessing and managing individual suppliers) and supply chain risk (the programme around them).
Vendor risk management
| Framework | Vendor Risk Mgmt | Link |
|---|---|---|
| NIST CSF 2.0 | GV.SC-04GV.SC-06GV.SC-07ID.RA-10DE.CM-06 | Topic definition |
| ISO 27001 | A.5.19A.5.20A.5.22 | Crosswalk |
| CIS v8.1 | CIS 15.1CIS 15.5CIS 15.6CIS 15.3CIS 15.4CIS 15.7 | Crosswalk |
| SOC 2 | CC9.2 | Editorial |
| PCI DSS | 12.8.112.8.212.8.312.8.412.8.5 | Crosswalk |
| CMMC | — | |
| 800-53 | SA-4SA-9SR-6 | Crosswalk |
| HIPAA | §164.308(b)(1)§164.314(a) | Crosswalk |
| GDPR | Art.28(1)Art.28(3) | Editorial |
| NIS2 | 5.15.26.1 | Crosswalk |
| Essential Eight | — | No mapping in our data |
Full detail and the reason for every link: Vendor Risk Mgmt across frameworks →
Supply chain risk as a programme
| Framework | Supply Chain Risk | Link |
|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.RA-09 | Topic definition |
| ISO 27001 | A.5.19A.5.21 | Crosswalk |
| CIS v8.1 | CIS 15.2 | Crosswalk |
| SOC 2 | CC9.2 | Editorial |
| PCI DSS | 6.3.212.8.1 | Crosswalk |
| CMMC | — | |
| 800-53 | PM-30SR-2SR-3SR-11 | Crosswalk |
| HIPAA | — | |
| GDPR | Art.28(1) | Editorial |
| NIS2 | 5.16.1 | Crosswalk |
| Essential Eight | — | No mapping in our data |
Full detail and the reason for every link: Supply Chain Risk across frameworks →
Where they agree
Most frameworks require the same lifecycle: know who your suppliers are, assess them before engaging, put security requirements in contracts, monitor them, and end the relationship securely. ISO 27001 covers it in A.5.19 to A.5.22; PCI DSS requires a list of service providers, written agreements, due diligence, annual monitoring and a documented split of responsibilities (12.8.1 to 12.8.5); SOC 2 expects vendor risk to be assessed and managed (CC9.2); the CIS Controls require an inventory, classification, contractual requirements, assessment, monitoring and secure decommissioning (Control 15). Build that lifecycle once, and the same process serves most of these frameworks.
Where they differ
- GDPR focuses on processors: written contracts with the terms in Article 28, and using only processors that give sufficient guarantees. It is about personal data, not suppliers generally.
- HIPAA requires business associate agreements (§164.308(b)(1), §164.314(a)) with anyone handling ePHI on your behalf.
- NIS2 treats supply chain security as a measure in its own right (Article 21(2)(d)), and the Implementing Regulation asks for a supply chain security policy, supplier selection criteria and contractual security requirements (points 5.1 and 5.2), considering suppliers' own security practices and vulnerabilities.
- NIST CSF 2.0 goes furthest, with ten Govern subcategories on cybersecurity supply chain risk management, from establishing a programme to managing suppliers through the whole lifecycle.
- CMMC Level 2 has no supplier practice; flow-down to subcontractors comes from contract clauses. The Essential Eight doesn't address suppliers.
What a good programme looks like
- One supplier inventory, with what each supplier can access and how critical it is.
- Tiered due diligence: more for suppliers with access to sensitive data or systems, less for the rest. Accept their SOC 2 report or ISO certificate where it covers the service, and read the scope.
- Contract requirements: security obligations, breach notification to you, audit rights and data return or deletion at exit (GDPR Article 28 terms where personal data is involved).
- Monitoring proportionate to the tier: annual reviews for critical suppliers, as PCI DSS requires of service providers.
- Offboarding: revoke access, retrieve or delete data, and confirm it.
The Vendor Risk and Supply Chain Risk topic pages list every requirement with its source. Our post on why a SOC 2 report doesn't answer the vendor question by itself covers reading supplier assurance.
Questions
What does NIS2 require on supply chain security?
Article 21(2)(d) requires supply chain security, including security aspects of relationships with direct suppliers and service providers. The Implementing Regulation sets out a supply chain security policy, supplier selection criteria and contract requirements (points 5.1 and 5.2).
Does CMMC Level 2 require vendor risk management?
Not as a programme. CMMC Level 2 inherits SP 800-171 Rev 2, which focuses on protecting CUI in your own systems; flow-down of requirements to subcontractors comes from the contract clauses instead.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.