NIST CSF 2.0 · Govern (GV)
GV.SC-05
Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
frameworkNIST Cybersecurity Framework 2.0
sectionGovern (GV)
topicsSupply Chain Risk
frameworks5 4 2
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| ISO 27001 | A.5.19A.5.21 | Information security in supplier relationships; Managing information security in the ICT supply chain | Crosswalk | Same topic: Supply Chain Risk3 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-05: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05: related, not a mapping |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Crosswalk | Same topic: Supply Chain Risk1 loosely related (not mappings)CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Only shares CSF GV.SC-05: related, not a mapping |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Crosswalk | Same topic: Supply Chain Risk5 loosely related (not mappings)12.8.3 Due diligence before engaging service providers Only shares CSF GV.SC-05: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.SC-05: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.SC-05: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.SC-05: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF GV.SC-05: related, not a mapping | |
| 800-53 | PM-30SR-2SR-3SR-11 | Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan… | Crosswalk | Same topic: Supply Chain Risk5 loosely related (not mappings) |
| HIPAA | §164.308(b)(1)§164.308(b)(4)§164.314(a)§164.314(a)(2)(i) | Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement… | No mapping. Only shares CSF GV.SC-05: related, not a mapping+3 more loosely related (not mappings)§164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-05: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF GV.SC-05: related, not a mapping | |
| GDPR | Art.28(1) | Processor | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | Same topic: Supply Chain Risk |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.28(2)Art.29(1)Art.29(2) | General principles; Preliminary assessment of ICT concentration risk at entity level… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.