Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-GV.SC-08 NIST Cybersecurity Framework 2.0
GV - Govern
NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 55 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CP-2(1) Coordinate with Related Plans CP-8 Telecommunications Services IR-3 Incident Response Testing IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3)) SR-8 Notification Agreements (SR-8) CP-2(1) Coordinate with Related Plans CP-8 Telecommunications Services IR-3 Incident Response Testing IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3)) SR-8 Notification Agreements (SR-8) 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the ICT supply chain 5.22 Monitoring, review and change management of supplier services 5.24 Information security incident management planning and preparation 5.30 ICT readiness for business continuity 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.22 Monitoring, review and change management of supplier services 5.24 Information security incident management planning and preparation CFTC-SS-27 Coordination of the Recovery Plan with Members and Market Participants CFTC-SS-28 Synchronised Testing with Members and Market Participants CFTC-SS-29 Recovery Plan Accounts for Essential Service Providers SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15) SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures CPS230-34 Tailoring of the Testing Program CPS230-46 Ongoing Risk Management of Each Material Arrangement ISM-0141 Incident reporting obligations for providers ISM-1638 Cloud service register contents CIS-17.2 Establish and Maintain Contact Information for Reporting Security Incidents CIS-17.7 Conduct Routine Incident Response Exercises 8.4 Business continuity plans and procedures 8.4.4 Business continuity plans 6.12.1 Information security in supplier relationships 6.13.1 Management of information security incidents and improvements SEC10-BP01 Identify key personnel and external resources C5-SIM-01 Policy for security incident management A.10 Third-party and customer relationships ID.SC-5 ID.SC-5: Response and recovery planning and testing are conducted with suppliers and third-party providers GV.SC-08 GV.SC-08 Relevant suppliers included in incident planning, response and recovery Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in GV - Govern NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed NIST-CSF-GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated NIST-CSF-GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-GV.SC-08 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 55 it maps to, and the evidence behind each claim, over MCP and REST.