The authenticity and integrity of hardware and software are assessed prior to acquisition and use

frameworkNIST Cybersecurity Framework 2.0 sectionIdentify (ID) topicsSupply Chain Risk frameworks5 4 2

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of ID.RA-09 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.5.19 A.5.21	Information security in supplier relationships; Managing information security in the ICT supply chain	Crosswalk	Same topic: Supply Chain Risk 2 loosely related (not mappings) A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF ID.RA-09: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.RA-09: related, not a mapping
CIS v8.1	CIS 15.2	Establish and Maintain a Service Provider Management Policy	Crosswalk	Same topic: Supply Chain Risk
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Supply Chain Risk (editorial pick)
PCI DSS	6.3.2 12.8.1	Inventory of custom software and its components; List of third-party service providers kept	Crosswalk	Same topic: Supply Chain Risk 2 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF ID.RA-09: related, not a mapping 9.5.1.1 Inventory of POI devices kept Loosely related Only shares CSF ID.RA-09: related, not a mapping
CMMC	RA.L2-3.11.1	Risk Assessments	Loosely related	No mapping. Only shares CSF ID.RA-09: related, not a mapping
800-53	PM-30 SR-2 SR-3 SR-11	Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan…	Crosswalk	Same topic: Supply Chain Risk 10 loosely related (not mappings) SA-4 Acquisition Process Loosely related Only shares CSF ID.RA-09: related, not a mapping SA-5 System Documentation Loosely related Only shares CSF ID.RA-09: related, not a mapping SA-10 Developer Configuration Management Loosely related Only shares CSF ID.RA-09: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.RA-09: related, not a mapping SA-15 Development Process, Standards, and Tools Loosely related Only shares CSF ID.RA-09: related, not a mapping SA-17 Developer Security and Privacy Architecture and Design Loosely related Only shares CSF ID.RA-09: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF ID.RA-09: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF ID.RA-09: related, not a mapping …and 2 more in the downloads
HIPAA	§164.308(b)(4)§164.312(c)§164.312(c)(2)§164.312(e)(2)(i)	Written Contract or Other Arrangement; Integrity…	Loosely related	No mapping. Only shares CSF ID.RA-09: related, not a mapping +3 more loosely related (not mappings) §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.RA-09: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.RA-09: related, not a mapping
GDPR	Art.28(1)	Processor	Editorial	Same topic: Supply Chain Risk (editorial pick)
NIS2	5.1 6.1	Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products	Crosswalk	Same topic: Supply Chain Risk
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(2)Art.29(1)Art.29(2)	General principles; Preliminary assessment of ICT concentration risk at entity level…	Editorial	Same topic: Supply Chain Risk (editorial pick)
CPS 234	Para 16 Para 22	Assess third parties' information security capability; Evaluate the design of third parties' controls	Editorial	Same topic: Supply Chain Risk (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.