NIST CSF 2.0 · Govern (GV)
GV.SC-09
Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
frameworkNIST Cybersecurity Framework 2.0
sectionGovern (GV)
topicsSupply Chain Risk
frameworks5 4 2
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| ISO 27001 | A.5.19A.5.21 | Information security in supplier relationships; Managing information security in the ICT supply chain | Crosswalk | Same topic: Supply Chain Risk |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Crosswalk | Same topic: Supply Chain Risk1 loosely related (not mappings) |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Crosswalk | Same topic: Supply Chain Risk |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF GV.SC-09: related, not a mapping | |
| 800-53 | PM-30SR-2SR-3SR-11 | Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan… | Crosswalk | Same topic: Supply Chain Risk10 loosely related (not mappings)…and 2 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(b)(1)§164.308(b)(4) | Risk Analysis; Risk Management… | No mapping. Only shares CSF GV.SC-09: related, not a mapping+6 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-09: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-09: related, not a mapping …and 2 more in the downloads | |
| GDPR | Art.28(1) | Processor | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | Same topic: Supply Chain Risk |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.28(2)Art.29(1)Art.29(2) | General principles; Preliminary assessment of ICT concentration risk at entity level… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.