Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-GV.SC-01 NIST Cybersecurity Framework 2.0
GV - Govern
NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 295 controls across 121 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1)) SR-1 Policy and Procedures (SR-1) SR-11 Component Authenticity (SR-11) SR-2 Supply Chain Risk Management Plan (SR-2) SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team (SR-2(1)) SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1)) SR-1 Policy and Procedures (SR-1) SR-11 Component Authenticity (SR-11) SR-2 Supply Chain Risk Management Plan (SR-2) SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team (SR-2(1)) SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) CPS230-16 Internal Audit Review of the Business Continuity Plan CPS230-27 Identification and Escalation of Incidents and Near Misses CPS230-37 Service Provider Management Policy CPS230-46 Ongoing Risk Management of Each Material Arrangement CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing CPS230-P12 Key Principles for Operational Risk, Resilience and Service Providers SASB-1 Business Model + Innovation (BMI) SASB-3 Leadership and Governance (LG) SASB-BMI-3 Supply Chain Management SASB-LG-2 Systemic Risk Management SASB-LG-3 Critical Incident Risk Management SASB-LG-5 Systemic Risk Management AEO-2 Demonstrated Compliance with Customs Requirements AEO-4 Financial Viability AEO-7 Trading Partner Security P1-S2 Risk-Management Systems P2-S1 Partnership CIS-15.1 Establish and Maintain an Inventory of Service Providers CIS-15.2 Establish and Maintain a Service Provider Management Policy CIS-15.3 Classify Service Providers CIS-15.4 Ensure Service Provider Contracts Include Security Requirements CIS-15.5 Assess Service Providers 27557-1 Scope 27557-3 Terms and definitions 27557-6.4 Privacy risk treatment 27557-6.6 Recording and reporting 27557-7.3 Risk-based privacy program implementation ISO-20400-4.5 Key considerations for sustainable procurement ISO-20400-7.3 Supplier selection ISO-20400-7.4 Contract management and review ISO-20400-7.5 Reviewing and learning 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the information and communication technology (ICT) supply chain 5.22 Monitoring, review and change management of supplier services 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the ICT supply chain 5.22 Monitoring, review and change management of supplier services 5.3.2 Policy 5.4.1 Actions to address risks and opportunities 6.11.1 Security requirements of information systems 6.12.1 Information security in supplier relationships ISO23894-5.1 Leadership and Commitment ISO23894-5.2 AI Risk Management Integration ISO23894-5.5 Framework Evaluation ISO23894-A.6 AI System Security ISO27003-4.2 Understanding the needs and expectations of interested parties ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.1 Operational planning and control ISO27003-8.3 Information security risk treatment ISO27019-21 Supply chain risk management for critical components ISO27019-22 Configuration management for OT systems ISO27019-23 Change management procedures ISO27019-24 Vulnerability assessment for critical systems SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain SOCI-S30AC Obligation to adopt a CIRMP SOCI-S30AD Compliance with CIRMP SOCI-S30AE Annual review of CIRMP SII-P2-09 Outsourcing Requirements SII-P2-11 Remuneration Policy SII-P2-12 Written Policies SII-P3-06 SFCR Section B: System of Governance API1164-21 TSA Pipeline Security Directive Alignment API1164-22 Configuration management for OT systems API1164-23 Change management procedures IS.D.OR.210 Information Security Risk Treatment IS.I.OR.210 Information Security Risk Treatment IS.I.OR.220 Information Security Risk Management FFIEC-03 Risk appetite and tolerance for IT risk FFIEC-18 Ongoing monitoring and assessment FFIEC-20 Exit strategy and transition planning 60601-1.4.1 General requirements 60601-1.4.2 Risk management process 60601-1.5.1 General requirements for testing IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-7.4 Risk Management of Software Changes IEC62443-21 Supply chain risk management for critical components IEC62443-22 Configuration management for OT systems IEC62443-23 Change management procedures A.1 Point-of-Care Testing Additional Requirements ISO-15189-5.6 Risk management ISO-15189-6.8 Externally provided products and services ISO28001-PC-03 Supply Chain Incident Reporting ISO28001-PC-04 Supply Chain Continuity Planning ISO28001-SA-04 Security Risk Treatment Planning NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System) NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF PCI-P2PE-16 Due diligence and onboarding PCI-P2PE-18 Ongoing monitoring and assessment PCI-P2PE-19 Concentration risk management PCI-PIN-16 Due diligence and onboarding PCI-PIN-18 Ongoing monitoring and assessment PCI-PIN-19 Concentration risk management PCI-SSF-03 Risk appetite and tolerance for IT risk PCI-SSF-16 Due diligence and onboarding PCI-SSF-17 Contractual security requirements RMI-DD-3 Red Flag Review RMI-MS-2 Cobalt Standard RMI-RMAP-2 Risk-Based Audit Approach SOC-CY-DC1 Nature of Business and Operations SOC-CY-DC3 Cybersecurity Risk Management Objectives SOC-CY-DC4 Governance Structure CPS234-16 Assessment of Related Party and Third Party Capability CPS234-20 Information Asset Classification AS9100D-8.1 Operational Planning and Control AS9100D-8.4 Control of Externally Provided Processes, Products, Services ISM-0731 Oversight of cyber supply chain risk management ISM-1785 Supplier relationship management policy BIMCO-1.8 Relationship with vendors and other external parties BIMCO-6.3 Third party risk assessments BS65000-RM-01 Resilience Journey BS65000-RM-02 Integrated Approach THIRD-1 Identify and Manage Third-Party Risk THIRD-2 Manage Supplier Relationships and Incident Notification CPG-6.A Vendor and Supplier Incident Reporting CPG-6.B Supply Chain Incident Reporting CIRMP-s10 Supply chain hazard management CIRMP-s8-FW Adoption of a recognised cyber security framework CAT-D1-2 Risk management CAT-ML-2 Evolving ICP-16 Enterprise Risk Management for Solvency Purposes ICP-8 Risk Management and Internal Controls ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OSFIB13-4 Third-Party Risk Management and Cloud PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs ISMSP-MS-02 Risk Management ISMSP-PI-03 Third-Party Provision and Outsourcing CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records AMLCTF-82 Part A Compliance SPS220-28 Annual Board Risk Management Declaration AESCSF-EDM-1 Supply chain risk management ACQ.4 Supplier Monitoring Mat 03 Responsible Sourcing of Materials BMA-8 Third-Party, Outsourcing and Cloud Risk C5-SSO-01 Policies and instructions for controlling and monitoring third parties CFTC-SS-30 Outsourcing with Retention of Complete Responsibility ITSG33-SA System and Services Acquisition (SA) DSL-Art24 National Security Review of Data Activities (Art. 24) CJIS-19 Supply Chain Risk Management Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) ISO22316-14 Supply chain continuity ISO-22320-4.3 Risk-based approach ISO-26000-6.6 Fair operating practices ISO-41001-8.4 Control of outsourced processes and services ISO-50001-8.3 Procurement 27010-15.1 Incident Management 27011-5.6 Supplier relationships and telecom supply chain ISO22317-14 Supply chain continuity ISO22318-14 Supply chain continuity Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider ID.SC-1 ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders 03.17.01 Supply Chain Risk Management Plan 3.11.7e Supply Chain Risk Management Plan 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) NZISM-1 NZISM Governance, Documentation, and Classification System ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture OECDMNE-5 Environment, Climate, and Biodiversity OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework PASONE-3 Personnel Security, Vetting, Awareness, and Training 12.8.3 12.8.3 Due diligence before engaging TPSPs PSPF-DIR-001-2024 Direction 001-2024: Foreign Ownership, Control or Influence - Technology Assets SAEIGHT-7 Management System, Worker Engagement, Continuous Improvement SECCLIM-2 Risk Management: Identification, Assessment, Integration SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management AIGF-1.1 Risk Management and Internal Controls IM8-TPM.4 Supply Chain Risk Management GT-3 Supply Chain Compromise TSSR-SEC-3 National Security Risk Management CRM-3 Risk Management Framework UKAI-1 Risk-Based Approach and Pro-Innovation Principles UKOPRES-5 Third-Party Risk, Concentration Risk UKGAMBLE-4 Resilience and Incident Response SEMD-PS-3 Supply Chain Security UK-TSA-NET-03 Supply Chain Security Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in GV - Govern NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-01 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 295 it maps to, and the evidence behind each claim, over MCP and REST.