Information security in supplier relationships

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.OV-01 GV.OV-02 GV.OV-03 GV.RM-05 GV.SC-01 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 GV.SC-10 ID.AM-08 ID.IM-02 ID.RA-09 ID.RA-10 topicsSupply Chain Risk, Vendor Risk Mgmt frameworks6 4 0

Official text · not licensableTitle: Information security in supplier relationships. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.19 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-01 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 ID.RA-09 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders…	Crosswalk	Same topic: Vendor Risk Mgmt, Supply Chain Risk 6 loosely related (not mappings) GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Loosely related Only shares CSF GV.RM-05: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping
CIS v8.1	CIS 15.1 CIS 15.2 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Establish and Maintain a Service Provider Management Policy…	Crosswalk	Same topic: Vendor Risk Mgmt, Supply Chain Risk 9 loosely related (not mappings) CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OV-03: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping
PCI DSS	6.3.2 12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	Inventory of custom software and its components; List of third-party service providers kept…	Crosswalk	Same topic: Supply Chain Risk, Vendor Risk Mgmt 37 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-02, GV.OV-03, GV.SC-03, GV.SC-09…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OV-02, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.RM-05: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.RM-05, GV.SC-01, GV.SC-05, GV.SC-07: related, not a mapping …and 29 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.1 CA.L2-3.12.4 RA.L2-3.11.2	Risk Assessments; Security Control Assessment…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.SC-03…: related, not a mapping +4 more loosely related (not mappings) RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10, ID.IM-02: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	PM-30 SA-4 SA-9 SR-2 SR-3 SR-6 SR-11 SR-1	Supply Chain Risk Management Strategy; Acquisition Process…	Crosswalk	Same topic: Supply Chain Risk, Vendor Risk Mgmt NIST SP 800-53 → ISO 27001 mapping 33 loosely related (not mappings) RA-7 Risk Response Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03, GV.SC-03…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, GV.SC-10…: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.SC-03, GV.SC-09…: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.RM-05, GV.SC-03…: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF GV.OV-03, ID.IM-02: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping PM-4 Plan of Action and Milestones Process Loosely related Only shares CSF GV.OV-03, ID.IM-02: related, not a mapping …and 25 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 37 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-03, GV.SC-09, GV.SC-10…: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-08…: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02: related, not a mapping …and 29 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping
NIS2	5.1 5.2 6.1 2.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Supply Chain Risk, Vendor Risk Mgmt ENISA NIS2 → ISO 27001 mapping 5 loosely related (not mappings) 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF ID.RA-10: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.28(2)Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.29(1)Art.29(2)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-08: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.