Frameworks / German Supply Chain Due Diligence Act (LkSG) / LkSG-Sec6-Policy-Preventive German Supply Chain Due Diligence Act (LkSG)
LkSG: Section 6 Policy Statement + Preventive Measures (Own + Direct Suppliers)
German Supply Chain Due Diligence Act (LkSG) LkSG-Sec6-Policy-Preventive: Section 6 Policy Statement and Preventive Measures (Own + Direct Suppliers) LkSG Section 6 - policy statement + preventive measures. POLICY STATEMENT (Section 6(2)): formal HUMAN RIGHTS STRATEGY published by senior management + addressing: (a) the company's procedure for fulfilling its due diligence obligations; (b) the human rights and environmental risks identified in the risk analysis; (c) the human rights and environmental expectations directed at the company's employees + the supply chain. Must be approved by senior management + reviewed annually + accessible to employees + suppliers + public. PREVENTIVE MEASURES (Section 6(3-4)): (a) FOR OWN BUSINESS: integration into business processes + procurement practices + remuneration systems + supplier selection + responsible procurement strategy + adequate funding + training for relevant personnel + procurement-control measures; (b) FOR DIRECT SUPPLIERS: contractual commitments + supplier code of conduct + training + audits + reasonable assurance through control mechanisms + supplier development support + ESCALATION + supplier-relationship-suspension/termination for substantial + repeated non-compliance. CONTRACT TERMS: anti-human-rights-violation clauses + audit rights + obligations to cascade requirements to sub-suppliers + remediation requirements + termination triggers. PROCUREMENT PRACTICES: avoid practices that contribute to human rights violations (e.g. unreasonable lead times + last-minute changes + cost pressures that incentivise overtime/wage non-payment).
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 179 controls across 95 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
API1164-07 Remote Access API1164-21 TSA Pipeline Security Directive Alignment API1164-22 Configuration management for OT systems API1164-23 Change management procedures API1164-24 Vulnerability assessment for critical systems IEC62443-07 Personnel risk assessment IEC62443-21 Supply chain risk management for critical components IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures IEC62443-24 Vulnerability assessment for critical systems ISO-20400-4.2 Principles of sustainable procurement ISO-20400-4.3 Core subjects of sustainable procurement ISO-20400-7.3 Supplier selection ISO-20400-7.4 Contract management and review ISO-20400-7.5 Reviewing and learning IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper ISO-26000-6.3.1 Due diligence ISO-26000-6.3.2 Human rights risk situations ISO-26000-6.3.3 Avoidance of complicity ISO-26000-6.6 Fair operating practices ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO23894-A.6 AI System Security ISO27003-4.2 Understanding the needs and expectations of interested parties ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.1 Operational planning and control ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures ISO27019-24 Vulnerability assessment for critical systems CPS230-11 Identification, Assessment and Management of Operational Risk CPS230-27 Identification and Escalation of Incidents and Near Misses CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy IATF16949-Clause6-Planning-Risk-Contingency-Objectives-Change IATF 16949 Clause 6 - Planning + Risks and Opportunities + Contingency Plans + Quality Objectives + Change IATF16949-Clause8-Operation-APQP-Design-Production-ControlPlan-SpecialChars IATF 16949 Clause 8 - Operation Planning + APQP + Design + Special Characteristics + Production + Control Plan + Set-Up Verification IATF16949-Clause8-Supplier-QMS-Development-Externally-Provided IATF 16949 Clause 8 Supplier - Control of Externally Provided Processes + Type and Extent + Supplier QMS Development 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure AQAP2110-1 Quality Management System Aligned to ISO 9001 plus NATO Supplementary Requirements AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access AQAP2110-6 Subcontractor Supply Chain Control plus Counterfeit Material Prevention NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight ISMSP-MS-02 Risk Management ISMSP-PI-03 Third-Party Provision and Outsourcing ISMSP-SYS-04 Vulnerability Management AEO-2 Demonstrated Compliance with Customs Requirements AEO-4 Financial Viability CPG-6.A Vendor and Supplier Incident Reporting CPG-6.B Supply Chain Incident Reporting IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment CJIS-17 Risk Assessment CJIS-19 Supply Chain Risk Management Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe A.1 Point-of-Care Testing Additional Requirements ISO-15189-6.8 Externally provided products and services ISO28001-PC-03 Supply Chain Incident Reporting ISO28001-PC-04 Supply Chain Continuity Planning 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering LLOYDS-CI-Systemic-Cyber-Risk-Aggregation-Cyber-Catastrophe-Modelling-Vendor-Use-RDS-Scenario-Testing Lloyds Cyber Insurance Systemic Aggregation + Catastrophe Modelling + RDS DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan IM8-SEC.4 Vulnerability Management IM8-TPM.4 Supply Chain Risk Management CH-FADP-21 Data protection impact assessments FADP-7 Data Protection Impact Assessment (Articles 9-10) CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records AMLCTF-PartA-RiskAssess ML/TF Risk Assessment AS9100D-8.4 Control of Externally Provided Processes, Products, Services 4.3.1 Risk Assessment and Impact Analysis ACQ.4 Supplier Monitoring BB-DPA-20 Sections 50-60 - Registration and Responsibilities LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety HKMA-CRAF-Domain1-2-Governance-Identification HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation ICMM-MP-P3-P4-HumanRights-RiskMgmt-UNGP-DueDiligence ICMM Mining Principles 3 + 4 - Human Rights (UNGPs Alignment) + Risk Management + Due Diligence IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA ISO-22313-8.2 Business impact analysis and risk assessment ISO22316-14 Supply chain continuity ISO-26262-3-7 Hazard analysis and risk assessment (HARA) ISO27799-06 Security management process and risk analysis ISO-41001-8.4 Control of outsourced processes and services ISO-50001-8.3 Procurement 27010-15.1 Incident Management 27011-5.6 Supplier relationships and telecom supply chain 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture ISO22317-14 Supply chain continuity ISO22318-14 Supply chain continuity INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing JP-AIG-Scope-METI-MIC-AI-Guidelines-Business-v1.0-April2024-Society-5.0-Cabinet-Office-AI-Strategy-Council Japan AI Guidelines Scope + METI/MIC AI Guidelines for Business v1.0 (April 2024) + Society 5.0 + Cabinet Office AI Strategy Council + 10 Principles 2019 Heritage + Education + Literacy + Fair Competition + Innovation Principles LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50 DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment OECDMNE-1 Concepts and General Policies, Risk-Based Due Diligence Framework OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08) OWASPTOP10-3 A03:2025 Injection Including Cross-Site Scripting AODACAN-2 Accessible Procurement of Goods, Services, Facilities AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 GT-3 Supply Chain Compromise TURKEYKVKK-3 Special Categories and Sensitive Data UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights CPSC-RA.3 Lifecycle Risk Assessment USMCADIGITAL-4 Government Data, Cybersecurity, Interoperability VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-4 Incident Reporting and Cooperation VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 179 it maps to, and the evidence behind each claim, over MCP and REST.