Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-GV.SC-05 NIST Cybersecurity Framework 2.0
GV - Govern
NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 120 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
11.3.2 11.3.2 Quarterly ASV external vulnerability scans 12.6.1 12.6.1 Formal security awareness program 12.8.2 12.8.2 TPSP contracts acknowledging account data responsibility 12.8.3 12.8.3 Due diligence before engaging TPSPs 12.8.5 12.8.5 Responsibility allocation between entity and TPSPs 12.9.1 12.9.1 TPSP written acknowledgments to customers 12.9.2 12.9.2 TPSP support for customer information requests 8.2.7 8.2.7 Third-party remote access accounts controlled CIS-15.2 Establish and Maintain a Service Provider Management Policy CIS-15.4 Ensure Service Provider Contracts Include Security Requirements CIS-15.5 Assess Service Providers CIS-15.6 Monitor Service Providers CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components PS-7 External Personnel Security SA-4 Acquisition Process SA-9 External System Services SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) SR-8 Notification Agreements (SR-8) PS-7 External Personnel Security SA-4 Acquisition Process SA-9 External System Services SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) SR-8 Notification Agreements (SR-8) 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the information and communication technology (ICT) supply chain 5.22 Monitoring, review and change management of supplier services 5.23 Information security for use of cloud services 8.30 Outsourced development 6.12 Supplier relationships 6.12.1 Information security in supplier relationships 7.2.6 Contracts with PII processors 7.5 PII sharing, transfer, and disclosure 8.5.7 Engagement of a subcontractor to process PII 8.5.8 Change of subcontractor to process PII 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the ICT supply chain 5.23 Information security for use of cloud services 8.30 Outsourced development ANSSI-HYG-01 Train Operational Teams in Information System Security ANSSI-HYG-03 Control the Risks of Outsourced Information System Management ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners ANSSI-HYG-42 Prefer Products and Services Qualified by ANSSI CPS230-45 APRA Access Provisions in Formal Agreements CPS230-50 Formal Agreement Content for Material Arrangements CPS230-P15 Precondition for Reliance on a Service Provider CPS230-P48 Required Content of the Service Provider Management Policy ISM-0072 Documenting data security requirements in contracts ISM-1571 Right to verify provider compliance ISM-1804 Break clauses for security failures C5-DEV-02 Outsourcing of the development C5-PI-02 Contractual agreements for the provision of data C5-SSO-01 Policies and instructions for controlling and monitoring third parties A.10 Third-party and customer relationships A.10.3 Suppliers A.4 Resources for AI systems SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures SEC03-BP09 Share resources securely with a third party SEC11-BP05 Centralize services for packages and dependencies MYHR-REG-4 Contracted service provider oversight MYHR-REG-8 Copyright conditions on handling old records for operators and service providers CFTC-SS-26 Own Resources or Contractual Arrangements to Meet the Recovery Objective CFTC-SS-30 Outsourcing with Retention of Complete Responsibility 3.11.7e Supply Chain Risk Management Plan 3.4.1e Authoritative Source for Software and Firmware 4(b)(iii) Sec. 4(b)(iii) Deploy routing security as a contracted internet service provider 7(c) Sec. 7(c) Carry the US Cyber Trust Mark on consumer IoT products sold to Government CPS234-P22 Evaluation of Third Party Control Design AEO-7 Trading Partner Security Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider ID.SC-3 ID.SC-3: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization's cybersecurity program and Cyber Supply Chain Risk Management Plan. GV.SC-05 GV.SC-05 Supplier requirements include incident disclosure and information sharing 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in GV - Govern NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-05 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 120 it maps to, and the evidence behind each claim, over MCP and REST.