Acquisition Strategies, Tools, and Methods

frameworkNIST SP 800-53 Rev 5.2 sectionSR Supply Chain Risk Management csf 2.0GV.OC-02 GV.OC-05 GV.SC-02 GV.SC-05 GV.SC-06 GV.SC-09 GV.SC-10 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-09 topics— frameworks1 0 0

Official textEmploy the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined strategies, tools, and methods].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SR-5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-02 GV.OC-05 GV.SC-02 GV.SC-05	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered; Outcomes, capabilities, and services that the organization depends on are understood and communicated…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OC-05, GV.SC-02, GV.SC-05: related, not a mapping +5 more loosely related (not mappings) GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
ISO 27001	A.5.20 A.5.21 A.5.23 A.8.29	Addressing information security within supplier agreements; Managing information security in the ICT supply chain…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 25 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, GV.SC-10…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-09: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-02, GV.SC-05, GV.SC-06: related, not a mapping A.5.8 Information security in project management Loosely related Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping A.5.2 Information security roles and responsibilities Loosely related Only shares CSF GV.SC-02: related, not a mapping …and 17 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 1.1 CIS 3.5	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-02, GV.SC-05, GV.SC-06, GV.SC-10…: related, not a mapping +9 more loosely related (not mappings) CIS 15.5 Assess Service Providers Loosely related Only shares CSF GV.SC-06: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
SOC 2	CC9.2 CC3.1 CC6.1	Managing vendor and business partner risk; Objectives specified clearly enough to identify risks…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, ID.RA-09…: related, not a mapping
PCI DSS	12.8.1 12.8.5 12.3.4 12.8.3	List of third-party service providers kept; Responsibilities split with each provider documented…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.OC-05, GV.SC-05, GV.SC-06…: related, not a mapping +28 more loosely related (not mappings) 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-05, GV.SC-02, GV.SC-09, ID.IM-02: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-10: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-10: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping …and 24 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.4 RA.L2-3.11.2 RA.L2-3.11.3	Risk Assessments; System Security Plan…	Loosely related	No mapping. Only shares CSF GV.OC-02, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping +3 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
HIPAA	§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii)	Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping +17 more loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-01…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-01…: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.IM-01, ID.IM-02…: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping …and 13 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.30(1)	Processor; Processor…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, ID.RA-09…: related, not a mapping
NIS2	5.1 6.1 1.1 1.2	Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping +4 more loosely related (not mappings) 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.OC-05: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-05: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.28(2)Art.29(1)Art.29(2)Art.8(1)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09, GV.OC-05…: related, not a mapping +9 more loosely related (not mappings) Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-05: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF GV.SC-06: related, not a mapping …and 5 more in the downloads
CPS 234	Para 16 Para 22 Para 20 Para 28	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-06, GV.SC-09, ID.RA-09…: related, not a mapping +1 more loosely related (not mappings) Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.SC-06: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.