800-53 · SR Supply Chain Risk Management
SR-3
Supply Chain Controls and Processes
frameworkNIST SP 800-53 Rev 5.2
sectionSR Supply Chain Risk Management
csf 2.0GV.OC-02 GV.SC-01 GV.SC-02 GV.SC-03 GV.SC-05 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 RS.CO-02 RS.CO-03 RS.MA-01
topicsSupply Chain Risk
frameworks5 4 1
Official texta. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] in coordination with [Assignment: organization-defined supply chain personnel];
b. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls]; and
c. Document the selected and implemented supply chain processes and controls in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document] ].NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls]; and
c. Document the selected and implemented supply chain processes and controls in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document] ].NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.RA-09 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes… | Crosswalk | Same topic: Supply Chain Risk8 loosely related (not mappings)GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Only shares CSF GV.SC-02: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping RS.CO-02 Internal and external stakeholders are notified of incidents Only shares CSF RS.CO-02: related, not a mapping RS.CO-03 Information is shared with designated internal and external stakeholders Only shares CSF RS.CO-03: related, not a mapping RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared Only shares CSF RS.MA-01: related, not a mapping |
| ISO 27001 | A.5.19A.5.21A.5.20 | Information security in supplier relationships; Managing information security in the ICT supply chain… | Crosswalk | Same topic: Supply Chain Risk NIST SP 800-53 → ISO 27001 mapping 21 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.26 Response to information security incidents Only shares CSF GV.SC-08, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.OC-02, GV.SC-01, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-02, GV.SC-05: related, not a mapping …and 13 more in the downloads |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Crosswalk | Same topic: Supply Chain Risk11 loosely related (not mappings)CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-02, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping CIS 15.7 Securely Decommission Service Providers Only shares CSF GV.SC-07, GV.SC-10: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping CIS 17.4 Establish and Maintain an Incident Response Process Only shares CSF RS.MA-01: related, not a mapping CIS 17.1 Designate Personnel to Manage Incident Handling Only shares CSF RS.MA-01: related, not a mapping CIS 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents Only shares CSF RS.CO-02: related, not a mapping …and 3 more in the downloads |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Crosswalk | Same topic: Supply Chain Risk29 loosely related (not mappings)12.8.5 Responsibilities split with each provider documented Only shares CSF GV.OC-02, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping 12.8.2 Written agreements with service providers Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-10…: related, not a mapping 12.8.3 Due diligence before engaging service providers Only shares CSF GV.SC-01, GV.SC-02, GV.SC-03, GV.SC-05…: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF GV.SC-02, GV.SC-08, GV.SC-10, RS.CO-02…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF GV.SC-01, GV.SC-02, GV.SC-07, GV.SC-09…: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-02, GV.SC-01, GV.SC-05, GV.SC-07…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-01, GV.SC-07, GV.SC-08, GV.SC-10: related, not a mapping …and 21 more in the downloads |
| CMMC | RA.L2-3.11.1IR.L2-3.6.2IR.L2-3.6.1RA.L2-3.11.2 | Risk Assessments; Incident Reporting… | No mapping. Only shares CSF GV.OC-02, GV.SC-03, GV.SC-05, GV.SC-07…: related, not a mapping+2 more loosely related (not mappings) | |
| HIPAA | §164.314(a)(2)(i)§164.314(a)(2)(iii)§164.308(b)(1)§164.308(b)(4) | Business Associate Contracts; Business associate contracts with subcontractors… | No mapping. Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping+31 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF GV.SC-03, GV.SC-08, RS.CO-02, RS.CO-03: related, not a mapping …and 27 more in the downloads | |
| GDPR | Art.28(1) | Processor | Editorial | Same topic: Supply Chain Risk (editorial pick)4 loosely related (not mappings)Art.33(1) Notification of a personal data breach to the supervisory authority Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping Art.33(5) Notification of a personal data breach to the supervisory authority Only shares CSF RS.MA-01: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RS.CO-02: related, not a mapping |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | Same topic: Supply Chain Risk7 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.OC-02: related, not a mapping |
| Essential Eight | ISM-0123ISM-0140ISM-1819 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…… | No mapping. Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping | |
| DORA | Art.28(2)Art.29(1)Art.29(2) | General principles; Preliminary assessment of ICT concentration risk at entity level… | Editorial | Same topic: Supply Chain Risk (editorial pick)16 loosely related (not mappings)Art.18(1) Classification of ICT-related incidents and cyber threats Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping Art.17(3)(d) ICT-related incident management process Only shares CSF RS.CO-03: related, not a mapping Art.19(1) Reporting of major ICT-related incidents and voluntary notification of significant cyber threats Only shares CSF RS.CO-02: related, not a mapping …and 8 more in the downloads |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Same topic: Supply Chain Risk (editorial pick)8 loosely related (not mappings)Para 25 Response plans cover all stages and escalation Only shares CSF RS.CO-03, RS.MA-01: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Only shares CSF RS.MA-01: related, not a mapping Para 24 Maintain information security response plans Only shares CSF RS.MA-01: related, not a mapping Para 28 Check third parties' control testing is adequate Only shares CSF GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.SC-07: related, not a mapping Para 35 Notify APRA of material incidents within 72 hours Only shares CSF RS.CO-02: related, not a mapping Para 36 Notify APRA of material control weaknesses within 10 business days Only shares CSF RS.CO-02: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.