Supply Chain Risk Management Plan

frameworkNIST SP 800-53 Rev 5.2 sectionSR Supply Chain Risk Management csf 2.0GV.RM-01 GV.RM-03 GV.RM-04 GV.SC-01 GV.SC-02 GV.SC-03 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-04 ID.IM-04 topicsSupply Chain Risk frameworks5 4 0

Official texta. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services];
b. Review and update the supply chain risk management plan [Assignment: organization-defined frequency] or as required, to address threat, organizational or environmental changes; and
c. Protect the supply chain risk management plan from unauthorized disclosure and modification.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SR-2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-09 ID.RA-09	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes…	Crosswalk	Same topic: Supply Chain Risk 7 loosely related (not mappings) GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders Loosely related Only shares CSF GV.RM-01: related, not a mapping GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Loosely related Only shares CSF GV.RM-03: related, not a mapping GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated Loosely related Only shares CSF GV.RM-04: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Loosely related Only shares CSF GV.SC-02: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-04 Inventories of services provided by suppliers are maintained Loosely related Only shares CSF ID.AM-04: related, not a mapping
ISO 27001	A.5.19 A.5.21 A.5.20 A.8.30	Information security in supplier relationships; Managing information security in the ICT supply chain…	Crosswalk	Same topic: Supply Chain Risk NIST SP 800-53 → ISO 27001 mapping 10 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-01, GV.RM-03, GV.RM-04, GV.SC-01…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-01, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.RM-01, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-01, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.RM-03, GV.RM-04, GV.SC-10: related, not a mapping A.5.26 Response to information security incidents Loosely related Only shares CSF GV.SC-08, ID.IM-04: related, not a mapping Clause 8.1 Operational planning and control Loosely related Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping A.5.2 Information security roles and responsibilities Loosely related Only shares CSF GV.SC-02: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 15.2	Establish and Maintain a Service Provider Management Policy	Crosswalk	Same topic: Supply Chain Risk 11 loosely related (not mappings) CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-02, GV.SC-08: related, not a mapping CIS 15.1 Establish and Maintain an Inventory of Service Providers Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 3 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Supply Chain Risk (editorial pick) 4 loosely related (not mappings) CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04: related, not a mapping
PCI DSS	6.3.2 12.8.1	Inventory of custom software and its components; List of third-party service providers kept	Crosswalk	Same topic: Supply Chain Risk 39 loosely related (not mappings) 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-03, GV.SC-01, GV.SC-02, GV.SC-03…: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.SC-01, GV.SC-08, GV.SC-09, GV.SC-10…: related, not a mapping 12.10.1 Incident response plan ready to activate Loosely related Only shares CSF GV.RM-04, GV.SC-02, GV.SC-08, GV.SC-10…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-03, GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.RM-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.SC-01, GV.SC-02, GV.SC-09, ID.AM-04: related, not a mapping …and 31 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.20 AC.L2-3.1.21 IR.L2-3.6.1	Risk Assessments; External Connections…	Loosely related	No mapping. Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-04…: related, not a mapping +3 more loosely related (not mappings) IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF GV.SC-08: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(B)§164.308(b)(1)§164.308(b)(4)§164.314(a)	Risk Management; Business Associate Contracts and Other Arrangements…	Loosely related	No mapping. Only shares CSF GV.RM-01, GV.RM-03, GV.SC-03, GV.SC-09…: related, not a mapping +28 more loosely related (not mappings) §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping …and 24 more in the downloads
GDPR	Art.28(1)	Processor	Editorial	Same topic: Supply Chain Risk (editorial pick) 3 loosely related (not mappings) Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	5.1 6.1	Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products	Crosswalk	Same topic: Supply Chain Risk 6 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.RM-03: related, not a mapping 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF GV.SC-02: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping
DORA	Art.28(2)Art.29(1)Art.29(2)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Editorial	Same topic: Supply Chain Risk (editorial pick) 10 loosely related (not mappings) Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.16(1) Simplified ICT risk management framework Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.24(1) General requirements for the performance of digital operational resilience testing Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 2 more in the downloads
CPS 234	Para 16 Para 22	Assess third parties' information security capability; Evaluate the design of third parties' controls	Editorial	Same topic: Supply Chain Risk (editorial pick) 5 loosely related (not mappings) Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.