Supplier Assessments and Reviews

frameworkNIST SP 800-53 Rev 5.2 sectionSR Supply Chain Risk Management csf 2.0GV.OC-02 GV.OV-01 GV.OV-02 GV.OV-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 GV.SC-10 ID.RA-09 ID.RA-10 topicsVendor Risk Mgmt frameworks7 4 2

Official textAssess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SR-6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Loosely related Only shares CSF GV.OC-02: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks Loosely related Only shares CSF GV.OV-02: related, not a mapping GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed Loosely related Only shares CSF GV.OV-03: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Loosely related Only shares CSF ID.RA-09: related, not a mapping
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt 23 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-02, GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping …and 15 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OV-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OV-03: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 34 loosely related (not mappings) 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OV-02, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, GV.SC-10: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.RA-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-02, GV.OV-03, GV.SC-09, GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03: related, not a mapping 12.4.2 Service providers: quarterly reviews of operational tasks Loosely related Only shares CSF GV.OV-01, GV.OV-02, GV.OV-03: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-02, GV.SC-05, GV.SC-07: related, not a mapping …and 26 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Crosswalk	NIST SP 800-171r3 03.11.01 → SP 800-53 3 loosely related (not mappings) RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OV-03: related, not a mapping
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Crosswalk	Same topic: Vendor Risk Mgmt 32 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.OV-01, GV.SC-09, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping …and 24 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OV-03: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 4 loosely related (not mappings) 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OV-02, GV.OV-03: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-02: related, not a mapping 2.2 Compliance monitoring Loosely related Only shares CSF GV.OV-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF ID.RA-10: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) Art.28(2) General principles Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OV-03: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OV-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OV-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.