Frameworks / IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) / IAEA-NSS17-SupplyChain-ThirdParty-OEM-Trust IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
IAEA NSS-17 Supply Chain + Third Party
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) IAEA-NSS17-SupplyChain-ThirdParty-OEM-Trust: IAEA NSS-17 - Supply Chain + Third Party + OEM + Vendor Security + Trustworthy Components NSS-17 + NSS-42-G require supply chain + third party + OEM security across CBS lifecycle. Vendor due diligence: cyber maturity assessment + ISO 27001 / IEC 62443 / IEC 27036 alignment + cybersecurity governance + secure development + incident history + foreign ownership control or influence (FOCI) per national rules + national security clearance where required; contract clauses (security requirements + audit right + breach notification 24 hours + patch obligations + EOL commitment + intellectual property + non-disclosure + sanctions compliance); vendor cybersecurity scorecard + periodic re-assessment. Trustworthy components: SBOM (per CISA SBOM Minimum Elements + SPDX/CycloneDX) + signed firmware + secure boot + integrity verification + counterfeit detection + provenance tracking; component categorisation (commercial off-the-shelf + open source + custom + Government-Off-The-Shelf GOTS); high-CSL components require additional assurance (FIPS 140-3 + Common Criteria + national approval + DBT-resistant). Trustworthy delivery: tamper-evident packaging + secure shipping + chain of custody + receiving inspection + verification + sanitisation of preinstalled software; software through trusted distribution channels only. Trustworthy operation: vendor remote access supervised + boundary-controlled + time-limited (per Access Control + Architecture controls); vendor field service technicians escorted + supervised + cleared per Personnel Security; software updates from verified channels + integrity check + staging test. Coordinates with NSS-23-G + NIST SP 800-161 + EO 14028 SBOM + IEC 62443-2-4 (Security for IACS Service Providers). IAEA NSS-17 + supply chain + vendor + OEM + trustworthy + SBOM applies.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 266 controls across 141 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
A.1 Point-of-Care Testing Additional Requirements ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-15189-6.8 Externally provided products and services ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-20400-7.3 Supplier selection ISO-20400-7.4 Contract management and review ISO-20400-7.5 Reviewing and learning NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-A.6 AI System Security DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing API1164-21 TSA Pipeline Security Directive Alignment API1164-22 Configuration management for OT systems API1164-23 Change management procedures ACQ.4 Supplier Monitoring MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement IATF16949-Clause8-Supplier-QMS-Development-Externally-Provided IATF 16949 Clause 8 Supplier - Control of Externally Provided Processes + Type and Extent + Supplier QMS Development IATF16949-Clause9-Performance-Monitoring-InternalAudit-ManagementReview IATF 16949 Clause 9 - Performance Evaluation + Monitoring + Internal Audit + Manufacturing Process Audit + Management Review IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62443-21 Supply chain risk management for critical components IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability IEEE1686-SupplyChain-Documentation-Procurement-ComplianceTable-Physical IEEE 1686 Section 6 IED Security Documentation + Supply Chain + Procurement Specification + Appendix A Compliance Table + Physical and Tamper ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO28001-PC-03 Supply Chain Incident Reporting ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-PI-01 Personnel Security Screening ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-41001-8.4 Control of outsourced processes and services ISO27003-4.2 Understanding the needs and expectations of interested parties ISO27003-4.3 Determining the scope of the information security management system ISO27003-8.1 Operational planning and control 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-5.6 Supplier relationships and telecom supply chain ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures ISO27019-24 Vulnerability assessment for critical systems 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles AQAP2110-1 Quality Management System Aligned to ISO 9001 plus NATO Supplementary Requirements AQAP2110-2 Government Quality Assurance Representative (GQAR) Authority and Access AQAP2110-6 Subcontractor Supply Chain Control plus Counterfeit Material Prevention NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NDPA-1 Applicability, Scope, and Carve-Outs NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-5 Security of Processing, Breach Notification, and DPIA CFR211-A-3 Section 211.3 - Definitions CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records 58.1 Scope 58.3 Definitions CPS230-27 Identification and Escalation of Incidents and Near Misses CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA AEO-2 Demonstrated Compliance with Customs Requirements AEO-4 Financial Viability CPG-6.A Vendor and Supplier Incident Reporting CPG-6.B Supply Chain Incident Reporting DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy IsraelPPL-Database-Registration-Definition-Document-Security-Level-Classification-Sec7-8-PPA-Registry Israel POPL Database Registration + Section 7 Database Definitions + Section 8 Registration Requirement + Database Definition Document + Security Level Classification + PPA Public Registry + Amendment 13 Threshold Changes IsraelPPL-Scope-5741-1981-Knesset-Amendment13-March2024-BasicLaw-Dignity-Sec1-Right-Privacy Israel Protection of Privacy Law 5741-1981 Scope + Knesset + Amendment No. 13 March 2024 + Basic Law Human Dignity and Liberty + Section 1 Right to Privacy + Constitutional Status + Chapter 1 Infringement of Privacy MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training C1 Organizational Boundary C3 Scope 1 and 2 Coverage IM8-RES.2 Disaster Recovery IM8-TPM.4 Supply Chain Risk Management ISMSP-PI-03 Third-Party Provision and Outsourcing ISMSP-SYS-04 Vulnerability Management USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-4 Government Data, Cybersecurity, Interoperability AS9100D-8.4 Control of Externally Provided Processes, Products, Services 4.4.1 Resources, Roles, Responsibility, and Authority AWWA-1.1 Security Policy and Governance AZ-DPA-2 Article 2 - Basic Concepts Mat 03 Responsible Sourcing of Materials COBIT-BAI02 Managed requirements definition CJIS-19 Supply Chain Risk Management FFIEC-05 Roles and responsibilities definition FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) CA-9 Internal System Connections CA-9 Internal System Connections ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICAO-ANX17-Chap1-Definitions-Scope-Chicago-Convention-AVSEC ICAO Annex 17 Chapter 1 - Definitions + Scope + Chicago Convention Article 37 + AVSEC Coverage 62351-2 Glossary of terms IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe ISO-14064-1-5.1 Organizational boundaries ISO22316-14 Supply chain continuity ISO-26000-6.6 Fair operating practices ISO-26262-3-5 Item definition ISO-50001-8.3 Procurement 27007-5.2 Audit Programme Objectives 27010-15.1 Incident Management ISO27043-04 Roles and responsibilities definition 27050-1.4 Terms and definitions 27400-3 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions ISO21434-04 Roles and responsibilities definition ISO22317-14 Supply chain continuity ISO22318-14 Supply chain continuity ITAR-Scope-AECA-22USC2778-22CFR120-130-DDTC-USML-21Categories-DefenseArticle-Service-TechnicalData ITAR Scope + Arms Export Control Act (22 USC 2778) + 22 CFR Parts 120-130 + Directorate of Defense Trade Controls (DDTC) + United States Munitions List (USML) 21 Categories + Defense Article/Service/Technical Data Definitions ITU-Scope-Constitution-Convention-Radio-Regulations-WRC-Quadrennial-Treaty-Art1-Definitions ITU Constitution + Convention + Radio Regulations Scope + Article 1 Definitions + Article 2 Nomenclature + WRC World Radiocommunication Conference Quadrennial Treaty Process + Member States + Sector Members BIPA-SEC5-1 Biometric Identifier Definition RBI-AA-Ecosystem-FIPs-FIUs-Interoperability-Onboarding-Sahamati-DPI-IndiaStack RBI AA Ecosystem - Financial Information Providers (FIPs) + Financial Information Users (FIUs) + Interoperability + Sahamati SRO Onboarding + DPI India Stack + Cross-Sector Regulators ItalyCodice-DataSubjectRights-Limitations-Deceased-Minors-14-Years-Italian-2undecies-2duodecies-2terdecies Italy Codice Data Subject Rights + Article 2-undecies Limitations + Article 2-duodecies Deceased Persons Rights + Article 2-terdecies Minors Rights (14 Years Consent Age) + GDPR Articles 15-22 + Italian Civil Procedure Remedies MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OWASPASVS-1 Architecture, Design and Threat Modelling (V1) OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08) AODACAN-2 Accessible Procurement of Goods, Services, Facilities 2.2.2 2.2.2 Vendor default accounts managed PSPF24-1 Security Culture, Governance, Risk Management EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) GT-3 Supply Chain Compromise FADP-5 Definitions (Article 5) TEFCAREC-1 Common Agreement Conformance and Onboarding 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 266 it maps to, and the evidence behind each claim, over MCP and REST.