German Supply Chain Due Diligence Act (LkSG)
LkSG: Section 6 Policy Statement + Preventive Measures (Own + Direct Suppliers)

German Supply Chain Due Diligence Act (LkSG) LkSG-Sec6-Policy-Preventive: Section 6 Policy Statement and Preventive Measures (Own + Direct Suppliers)

LkSG Section 6 - policy statement + preventive measures. POLICY STATEMENT (Section 6(2)): formal HUMAN RIGHTS STRATEGY published by senior management + addressing: (a) the company's procedure for fulfilling its due diligence obligations; (b) the human rights and environmental risks identified in the risk analysis; (c) the human rights and environmental expectations directed at the company's employees + the supply chain. Must be approved by senior management + reviewed annually + accessible to employees + suppliers + public. PREVENTIVE MEASURES (Section 6(3-4)): (a) FOR OWN BUSINESS: integration into business processes + procurement practices + remuneration systems + supplier selection + responsible procurement strategy + adequate funding + training for relevant personnel + procurement-control measures; (b) FOR DIRECT SUPPLIERS: contractual commitments + supplier code of conduct + training + audits + reasonable assurance through control mechanisms + supplier development support + ESCALATION + supplier-relationship-suspension/termination for substantial + repeated non-compliance. CONTRACT TERMS: anti-human-rights-violation clauses + audit rights + obligations to cascade requirements to sub-suppliers + remediation requirements + termination triggers. PROCUREMENT PRACTICES: avoid practices that contribute to human rights violations (e.g. unreasonable lead times + last-minute changes + cost pressures that incentivise overtime/wage non-payment).

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 195 controls across 105 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

API 1164 · 5 controls

IEC 62443 · 5 controls

IEEE 1686 · 4 controls

ISO 26000:2010 · 4 controls

ISO 27019 · 4 controls

ISO/IEC 23894:2023 · 4 controls

ISO/IEC 27003:2017 · 4 controls

  • CPS230-11 Identification, Assessment and Management of Operational Risk
  • CPS230-27 Identification and Escalation of Incidents and Near Misses
  • CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 29134:2023 · 3 controls

  • AQAP2110-1 Quality Management System Aligned to ISO 9001 plus NATO Supplementary Requirements
  • AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access
  • AQAP2110-6 Subcontractor Supply Chain Control plus Counterfeit Material Prevention
  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

South Korea ISMS-P · 3 controls

  • AEO-2 Demonstrated Compliance with Customs Requirements
  • AEO-4 Financial Viability
  • CPG-6.A Vendor and Supplier Incident Reporting
  • CPG-6.B Supply Chain Incident Reporting
  • A.1 Point-of-Care Testing Additional Requirements
  • ISO-15189-6.8 Externally provided products and services

ISO/IEC 27014:2020 · 2 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management
  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing
  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process
  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan
  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)
  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment
  • CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records
  • AS9100D-8.4 Control of Externally Provided Processes, Products, Services
  • AS9100D-8.4 Control of Externally Provided Processes, Products, Services
  • 4.3.1 Risk Assessment and Impact Analysis

Bahrain PDPL · 1 control

  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

GDPR · 1 control

IEEE 7000 · 1 control

ISMAP (Japan) · 1 control

ISO 13485 · 1 control

  • ISO13485-06 Security management process and risk analysis

ISO 22000 · 1 control

ISO 22316 · 1 control

ISO 22317 · 1 control

ISO 22318 · 1 control

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO 27799 · 1 control

  • ISO27799-06 Security management process and risk analysis

ISO 45001 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27011:2024 · 1 control

  • 27011-5.6 Supplier relationships and telecom supply chain

ISO/IEC 27031:2011 · 1 control

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

India DPDP Act · 1 control

Indonesia PDP Law · 1 control

Japan AI Guidelines · 1 control

LGPD · 1 control

Liechtenstein DPA · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • OECDMNE-1 Concepts and General Policies, Risk-Based Due Diligence Framework
  • OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08)

OWASP Top 10:2025 · 1 control

  • OWASPTOP10-3 A03:2025 Injection Including Cross-Site Scripting
  • AODACAN-2 Accessible Procurement of Goods, Services, Facilities
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children

South Korea PIPA · 1 control

Turkey KVKK · 1 control

  • UNGPBHR-2 Pillar II: Corporate Responsibility to Respect Human Rights
  • VPSHR-3 Implementation Guidance and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 195 it maps to, and the evidence behind each claim, over MCP and REST.