SIG risk domain S, Supply Chain Risk Management. Added with the 2024 SIG, this domain covers exposures, threats and vulnerabilities associated with the products and services moving through the supply chain and to the supply chain itself, including technology acquisition and development assessed from a cybersecurity supply chain perspective, with more stringent review of suppliers of technology, systems or components; the 2024 SIG maps it to NIST SP 800-161r1.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.