NIST Cybersecurity Framework 2.0
GV - Govern

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally

Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally

What else in your programme already covers this

This control maps to 57 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 5 controls

SOC 2 · 5 controls

  • SOC2-CC1.3 COSO principle 3: Management establishes structures, reporting lines, and authorities
  • SOC2-CC2.3 COSO principle 15: Communicates with external parties regarding matters affecting controls
  • SOC2-CC5.3 COSO principle 12: Deploys control activities through policies and procedures
  • SOC2-CC9.2 Risk mitigation activities include assessment of vendor and business partner controls
  • SOC2-P6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed

ISO 27001:2022 · 4 controls

  • 5.19 Information security in supplier relationships
  • 5.20 Addressing information security within supplier agreements
  • 5.21 Managing information security in the ICT supply chain
  • 5.22 Monitoring, review and change management of supplier services

ISO 27701:2019 · 4 controls

  • 6.12 Supplier relationships
  • 6.12.1 Information security in supplier relationships
  • 7.2.6 Contracts with PII processors
  • 8.5.7 Engagement of a subcontractor to process PII

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ISO 27002:2022 · 3 controls

  • 5.19 Information security in supplier relationships
  • 5.20 Addressing information security within supplier agreements
  • 8.30 Outsourced development

NIST SP 800-161 Rev 1 · 3 controls

FedRAMP High · 2 controls

  • SA-9 External System Services
  • SR-2 Supply Chain Risk Management Plan (SR-2)

FedRAMP Moderate · 2 controls

  • SA-9 External System Services
  • SR-2 Supply Chain Risk Management Plan (SR-2)

HIPAA Security Rule · 2 controls

ISO/IEC 42001:2023 · 2 controls

  • A.10.2 Allocating responsibilities
  • A.3 Internal organization

NIST SP 800-53 Rev 5 LOW · 2 controls

  • SA-9 External System Services
  • SR-2 Supply Chain Risk Management Plan (SR-2)

NIST SP 800-53 Rev 5 MODERATE · 2 controls

  • SA-9 External System Services
  • SR-2 Supply Chain Risk Management Plan (SR-2)

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

  • SA-9 External System Services
  • SR-2 Supply Chain Risk Management Plan (SR-2)

PCI DSS 4.0 · 2 controls

  • 12.8.2 Written agreements with TPSPs
  • 12.8.5 Responsibility matrix with TPSPs

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-03 Control the Risks of Outsourced Information System Management

APRA CPS 220 Risk Management · 1 control

  • CPS220-P12 Identification of Group Derived Framework Elements

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-50 Formal Agreement Content for Material Arrangements

APRA CPS 234 · 1 control

  • CPS234-P19 Policy Direction to All Responsible Parties

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-P17 Identification of Group Derived Framework Elements

Australia My Health Records Act 2012 · 1 control

Australian Information Security Manual · 1 control

  • ISM-1569 A shared responsibility model is created, documented and shared between suppliers and thei

C5 (Germany) · 1 control

  • C5-SSO-01 Policies and instructions for controlling and monitoring third parties

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-30 Outsourcing with Retention of Complete Responsibility

CIS Controls v8 · 1 control

  • CIS-15.4 Ensure Service Provider Contracts Include Security Requirements

Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 · 1 control

DORA · 1 control

NIS2 Directive · 1 control

  • Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider

NIST SP 800-171 Rev 3 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in GV - Govern

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gapsIf you hold NIST SP 800-53 Rev 567.9% covered · 34 gapsIf you hold C5 (Germany)67% covered · 35 gapsIf you hold FedRAMP Moderate63.2% covered · 39 gapsIf you hold ISO 27002:202258.5% covered · 44 gapsIf you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 57 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST Cybersecurity Framework 2.0 controls