Risiko Rantai Pasok
Kelola risiko keamanan siber dalam rantai pasok.
Risiko Rantai Pasok didefinisikan oleh hasil-hasil NIST CSF 2.0 GV.SC-01 (A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders); GV.SC-03 (Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes); GV.SC-05 (Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties); GV.SC-09 (Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle); ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use). Crosswalk Dipetakan melalui crosswalk yang dipublikasikan dalam ISO 27001, CIS v8.1, PCI DSS, 800-53 dan NIS2. Editorial Dipetakan secara editorial dalam SOC 2, GDPR, DORA dan CPS 234. Hanya terkait secara longgar dalam CMMC dan HIPAA. Tidak ada pemetaan dalam data kami Tidak ada pemetaan dalam data kami untuk Essential Eight dan Cyber Essentials.
| Kerangka kerja | Persyaratan | Judul | Tautan | Sumber / alasan |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.RA-09 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes; Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties… | Definisi topik | GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-09 ID.RA-09 |
| ISO 27001 | A.5.19A.5.21 | Information security in supplier relationships; Managing information security in the ICT supply chain | Crosswalk | A.5.19: via GV.SC-01; GV.SC-03; GV.SC-05; GV.SC-09; ID.RA-09; NIST 800-53 map: SR-2 A.5.21: via GV.SC-01; GV.SC-03; GV.SC-09; NIST 800-53 map: SR-2, SR-3 |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Crosswalk | CIS 15.2: via GV.SC-01 |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | CC9.2: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Crosswalk | 6.3.2: via GV.SC-01; GV.SC-03; GV.SC-09 12.8.1: via GV.SC-01; GV.SC-05; GV.SC-09 |
| CMMC | RA.L2-3.11.1 | Tidak dipetakan ke topik ini | Persyaratan ini hanya berbagi hasil CSF topik ini (GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09) melalui crosswalk yang diterbitkan: layak diperiksa, bukan pemetaan. | |
| 800-53 | PM-30SR-2SR-3SR-11 | Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan; Supply Chain Controls and Processes… | Crosswalk | PM-30: via GV.SC-01; GV.SC-03; GV.SC-09 SR-2: via GV.SC-01; GV.SC-03; GV.SC-09 SR-3: via GV.SC-01; GV.SC-03; GV.SC-05; GV.SC-09 SR-11: via ID.RA-09 |
| HIPAA | §164.308(a)(1)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B) | Tidak dipetakan ke topik ini | Persyaratan ini hanya berbagi hasil CSF topik ini (GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09) melalui crosswalk yang diterbitkan: layak diperiksa, bukan pemetaan. | |
| GDPR | Art.28(1) | Processor | Editorial | Art.28(1): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | 5.1: via GV.SC-01; GV.SC-05; GV.SC-09; ENISA ISO map: A.5.19, A.5.21 6.1: via ID.RA-09; ENISA ISO map: A.5.21 |
| Essential Eight | — | Tidak ada persyaratan | Tidak ada pemetaan dalam data kami | Tidak ada persyaratan Essential Eight yang dipetakan ke topik ini dalam data kami. |
| DORA | Art.28(2)Art.29(1)Art.29(2) | General principles; Preliminary assessment of ICT concentration risk at entity level; Preliminary assessment of ICT concentration risk at entity level | Editorial | Art.28(2): A strategy on ICT third-party risk, with a policy on ICT services supporting critical or important functions. Art.29(1): Assess ICT concentration risk before contracting, such as providers that aren't easily substitutable. Art.29(2): Weigh the risks of subcontracting chains, insolvency law and providers in third countries. |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Para 16: Assess the information security capability of related parties and third parties that manage information assets. Para 22: Evaluate the design of third parties' controls that protect the entity's information assets. |
| Cyber Essentials | — | Tidak ada persyaratan | Tidak ada pemetaan dalam data kami | Tidak ada persyaratan Cyber Essentials yang dipetakan ke topik ini dalam data kami. |
Definisi topik Hasil CSF 2.0 yang mendefinisikan topik ini · Crosswalk setidaknya satu pilihan didukung crosswalk yang dipublikasikan · Editorial Penilaian ControlMapping, beserta alasannya · belum dipetakan, hanya berbagi hasil CSF untuk topik ini · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Metodologi.
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Pemetaan salah atau belum ada? Laporkan
Tentang Risiko Rantai Pasok
Manajemen risiko rantai pasok menangani kerentanan keamanan yang timbul dari penyedia perangkat keras, perangkat lunak, dan layanan pihak ketiga yang memiliki akses ke sistem atau data organisasi. Organisasi sebaiknya mengevaluasi postur keamanan pemasok sebelum melakukan onboarding, mencantumkan persyaratan keamanan dalam kontrak, serta memantau kepatuhan berkelanjutan melalui kuesioner, audit, atau alat pemantauan berkelanjutan. Serangan rantai pasok berprofil tinggi seperti SolarWinds dan MOVEit telah menunjukkan bahwa organisasi yang sudah mengamankan sistemnya dengan baik pun dapat disusupi melalui hubungan dengan vendor tepercaya.