NSS-17 + NSS-42-G require supply chain + third party + OEM security across CBS lifecycle. Vendor due diligence: cyber maturity assessment + ISO 27001 / IEC 62443 / IEC 27036 alignment + cybersecurity governance + secure development + incident history + foreign ownership control or influence (FOCI) per national rules + national security clearance where required; contract clauses (security requirements + audit right + breach notification 24 hours + patch obligations + EOL commitment + intellectual property + non-disclosure + sanctions compliance); vendor cybersecurity scorecard + periodic re-assessment. Trustworthy components: SBOM (per CISA SBOM Minimum Elements + SPDX/CycloneDX) + signed firmware + secure boot + integrity verification + counterfeit detection + provenance tracking; component categorisation (commercial off-the-shelf + open source + custom + Government-Off-The-Shelf GOTS); high-CSL components require additional assurance (FIPS 140-3 + Common Criteria + national approval + DBT-resistant). Trustworthy delivery: tamper-evident packaging + secure shipping + chain of custody + receiving inspection + verification + sanitisation of preinstalled software; software through trusted distribution channels only. Trustworthy operation: vendor remote access supervised + boundary-controlled + time-limited (per Access Control + Architecture controls); vendor field service technicians escorted + supervised + cleared per Personnel Security; software updates from verified channels + integrity check + staging test. Coordinates with NSS-23-G + NIST SP 800-161 + EO 14028 SBOM + IEC 62443-2-4 (Security for IACS Service Providers). IAEA NSS-17 + supply chain + vendor + OEM + trustworthy + SBOM applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.