ISO/IEC 42001:2023 A.10.3: Suppliers

What else in your programme already covers this

This control maps to 44 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 5 controls

SA-4 Acquisition Process
SA-9 External System Services
SR-2 Supply Chain Risk Management Plan (SR-2)
SR-3 Supply Chain Controls and Processes (SR-3)
SR-6 Supplier Assessments and Reviews (SR-6)

FedRAMP Moderate · 5 controls

SA-4 Acquisition Process
SA-9 External System Services
SR-2 Supply Chain Risk Management Plan (SR-2)
SR-3 Supply Chain Controls and Processes (SR-3)
SR-6 Supplier Assessments and Reviews (SR-6)

NIST SP 800-53 Rev 5 · 5 controls

NIST800-SA-4 SA-4 Acquisition Process
NIST800-SA-9 SA-9 External System Services
NIST800-SR-2 SR-2 Supply Chain Risk Management Plan
NIST800-SR-3 SR-3 Supply Chain Controls and Processes
NIST800-SR-6 SR-6 Supplier Assessments and Reviews

ISO 27001:2022 · 4 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
5.21 Managing information security in the information and communication technology (ICT) supply chain
8.30 Outsourced development

EU AI Act · 3 controls

EUAI-Art.23 Obligations of importers
EUAI-Art.24 Obligations of distributors
EUAI-Art.25 Responsibilities along the AI value chain

ISO 27002:2022 · 3 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
8.30 Outsourced development

NIST AI Risk Management Framework (AI RMF 1.0) · 3 controls

AIRMF-GV-6.1 Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third party's intellectual property or other rights
AIRMF-MN-3.1 AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented
AIRMF-MP-4.2 Internal risk controls for components of the AI system including third-party AI technologies are identified and documented

CIS Controls v8 · 2 controls

CIS-15.1 Establish and Maintain an Inventory of Service Providers
CIS-15.2 Establish and Maintain a Service Provider Management Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-STA-08 Supply Chain Risk Management
CCM-STA-09 Primary Service and Contractual Agreement

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.SC-04 Suppliers are known and prioritized by criticality
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-03 Control the Risks of Outsourced Information System Management

APPI · 1 control

APPI-A25 Supervision of Trustees

APRA CPS 234 · 1 control

CPS234-16 Assessment of Related Party and Third Party Capability

Australia National Framework for the Assurance of AI in Government (2024) · 1 control

C.5 C.5 Procurement cornerstone: AI-aware procurement and contracts

HIPAA Security Rule · 1 control

164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

NIST SP 800-171 Rev 3 · 1 control

03.17.01 Supply Chain Risk Management Plan

NIST SP 800-218 · 1 control

SP800-218-PO.1.3 Communicate Requirements to Third-Party Providers

NIST SP 800-66 Rev 2 · 1 control

164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)

NSW AI Operational Policy (2026) · 1 control

5.4.2.f 5.4.2 f Management of third-party supplier risks

SOC 2 · 1 control

SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.10.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free