Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-GV.SC-06 What else in your programme already covers this This control maps to 80 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1)) SA-4 Acquisition Process SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1)) SR-11 Component Authenticity (SR-11) SR-2 Supply Chain Risk Management Plan (SR-2) SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) SR-6 Supplier Assessments and Reviews (SR-6) RA-3(1) Risk Assessment | Supply Chain Risk Assessment (RA-3(1)) SA-4 Acquisition Process SA-9(1) External System Services | Risk Assessments and Organizational Approvals (SA-9(1)) SR-11 Component Authenticity (SR-11) SR-2 Supply Chain Risk Management Plan (SR-2) SR-3 Supply Chain Controls and Processes (SR-3) SR-5 Acquisition Strategies, Tools, and Methods (SR-5) SR-6 Supplier Assessments and Reviews (SR-6) 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the information and communication technology (ICT) supply chain 5.22 Monitoring, review and change management of supplier services 5.23 Information security for use of cloud services CIS-15.1 Establish and Maintain an Inventory of Service Providers CIS-15.3 Classify Service Providers CIS-15.4 Ensure Service Provider Contracts Include Security Requirements CIS-15.5 Assess Service Providers SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties CPS230-43 Due Diligence Before Entering or Modifying a Material Arrangement CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing CPS230-P15 Precondition for Reliance on a Service Provider ISM-1567 Excluding high risk suppliers ISM-1568 Suppliers committed to product security ISM-1632 Suppliers with a strong security track record ANSSI-HYG-03 Control the Risks of Outsourced Information System Management ANSSI-HYG-42 Prefer Products and Services Qualified by ANSSI CPS234-16 Assessment of Related Party and Third Party Capability CPS234-P22 Evaluation of Third Party Control Design SEC06-BP02 Provision compute from hardened images SEC11-BP05 Centralize services for packages and dependencies 6.1.2 Addressing risks and opportunities 8.2.3 Risk assessment 5.19 Information security in supplier relationships 5.21 Managing information security in the ICT supply chain 6.12.1 Information security in supplier relationships 8.5.8 Change of subcontractor to process PII 3.11.7e Supply Chain Risk Management Plan 3.14.3e Include Systems in Scope of Enhanced Requirements or Segregate into Purpose-Specific Networks C5-SSO-02 Risk assessment of service providers and suppliers 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) Art.21.3 Take account of supplier-specific vulnerabilities and of Union coordinated supply chain risk assessments ID.SC-1 ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders 03.17.02 Acquisition Strategies, Tools, and Methods 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) 12.8.3 12.8.3 Due diligence before engaging TPSPs Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in GV - Govern NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-06 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.