Supply Chain Risk Management Strategy

frameworkNIST SP 800-53 Rev 5.2 sectionPM Program Management csf 2.0DE.AE-04 GV.OC-02 GV.OC-04 GV.OC-05 GV.OV-01 GV.OV-02 GV.RM-03 GV.RM-04 GV.RM-05 GV.RM-06 GV.RM-07 GV.SC-01 GV.SC-03 GV.SC-09 ID.RA-06 topicsSupply Chain Risk frameworks5 4 1

Official texta. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
b. Implement the supply chain risk management strategy consistently across the organization; and
c. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PM-30 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-09 ID.RA-09	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes…	Crosswalk	Same topic: Supply Chain Risk 12 loosely related (not mappings) DE.AE-04 The estimated impact and scope of adverse events are understood Loosely related Only shares CSF DE.AE-04: related, not a mapping GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Loosely related Only shares CSF GV.OC-02: related, not a mapping GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Loosely related Only shares CSF GV.OC-04: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Loosely related Only shares CSF GV.RM-03: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Loosely related Only shares CSF GV.RM-04: related, not a mapping …and 4 more in the downloads
ISO 27001	A.5.19 A.5.21 Clause 4.4 Clause 6.2 Clause 7.5.1 Clause 7.5.2 Clause 7.5.3	Information security in supplier relationships; Managing information security in the ICT supply chain…	Crosswalk	Same topic: Supply Chain Risk NIST SP 800-53 → ISO 27001 mapping 24 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.RM-03, GV.RM-04…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04, GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-03, GV.RM-04, GV.RM-05, ID.RA-06: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.RM-05, GV.RM-07, GV.SC-09: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF GV.OC-02, GV.SC-01, GV.SC-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-01, GV.SC-09: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-02, GV.OC-04: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-06, GV.SC-09: related, not a mapping …and 16 more in the downloads
CIS v8.1	CIS 15.2	Establish and Maintain a Service Provider Management Policy	Crosswalk	Same topic: Supply Chain Risk 1 loosely related (not mappings) CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Supply Chain Risk (editorial pick) 9 loosely related (not mappings) CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04, GV.OC-05, GV.RM-03, GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04, GV.RM-03, GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04: related, not a mapping CC3.2 Risk identification and analysis Loosely related Only shares CSF ID.RA-06: related, not a mapping CC3.3 Considering the potential for fraud Loosely related Only shares CSF ID.RA-06: related, not a mapping CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-06: related, not a mapping …and 1 more in the downloads
PCI DSS	6.3.2 12.8.1	Inventory of custom software and its components; List of third-party service providers kept	Crosswalk	Same topic: Supply Chain Risk 44 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03…: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03…: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-02, GV.RM-03, GV.RM-06, GV.SC-03…: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-05, GV.OV-02, GV.RM-05, GV.SC-01…: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.RA-06: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-03, GV.RM-06, GV.SC-01, GV.SC-03: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.OC-02, GV.RM-05, GV.SC-01, GV.SC-09: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-02, GV.OC-05, GV.RM-05, GV.SC-01: related, not a mapping …and 36 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OV-01, GV.OV-02, GV.RM-06…: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(1)(ii)(A)§164.308(a)(7)	Risk Management; Policies and Procedures…	Loosely related	No mapping. Only shares CSF GV.RM-03, GV.RM-06, GV.RM-07, GV.SC-03…: related, not a mapping +34 more loosely related (not mappings) §164.308(a)(1) Security Management Process Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping …and 30 more in the downloads
GDPR	Art.28(1)	Processor	Editorial	Same topic: Supply Chain Risk (editorial pick) 5 loosely related (not mappings) Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.35(1) Data protection impact assessment Loosely related Only shares CSF ID.RA-06: related, not a mapping Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-06: related, not a mapping
NIS2	5.1 6.1	Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products	Crosswalk	Same topic: Supply Chain Risk 11 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06, ID.RA-06: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-02, GV.RM-03: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02: related, not a mapping 3.4 Event assessment and classification Loosely related Only shares CSF DE.AE-04: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.OC-04: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-04: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.OC-05: related, not a mapping …and 3 more in the downloads
Essential Eight	ISM-1228	Cyber security events are analysed in a timely manner to identify cyber security incidents	Loosely related	No mapping. Only shares CSF DE.AE-04: related, not a mapping
DORA	Art.28(2)Art.29(1)Art.29(2)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Editorial	Same topic: Supply Chain Risk (editorial pick) 14 loosely related (not mappings) Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Art.8(2) Identification Loosely related Only shares CSF ID.RA-06: related, not a mapping …and 6 more in the downloads
CPS 234	Para 16 Para 22	Assess third parties' information security capability; Evaluate the design of third parties' controls	Editorial	Same topic: Supply Chain Risk (editorial pick) 6 loosely related (not mappings) Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF ID.RA-06: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-06: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.