Singapore Government Instruction Manual on ICT&SS Management (IM8)
Third Party and Supply Chain

Singapore Government Instruction Manual on ICT&SS Management (IM8) TPM.4: Supply Chain Risk Management

Agencies must manage supply chain risks associated with ICT products and services procurement.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 255 controls across 109 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SASB Standards · 6 controls

APRA CPS 230 Operational Risk Management · 5 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-27 Identification and Escalation of Incidents and Near Misses
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement
  • CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
  • NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition

Authorised Economic Operator (AEO) Programmes - Global Standards · 4 controls

  • AEO-2 Demonstrated Compliance with Customs Requirements
  • AEO-4 Financial Viability
  • P1-S2 Risk-Management Systems
  • P2-S1 Partnership

ISO 20400:2017 - Sustainable Procurement · 4 controls

ISO 27019 · 4 controls

ISO/IEC 23894:2023 · 4 controls

ISO/IEC 27003:2017 · 4 controls

Security of Critical Infrastructure Act 2018 (SOCI) · 4 controls

Solvency II · 4 controls

TISAX - Trusted Information Security Assessment Exchange · 4 controls

API 1164 · 3 controls

EASA Part-IS - Information Security in Aviation · 3 controls

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

German Supply Chain Due Diligence Act (LkSG) · 3 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

IEC 62443 · 3 controls

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 3 controls

ISO 27005 · 3 controls

ISO 28001:2007 Supply Chain Security Management · 3 controls

ISO 31000 · 3 controls

Japan AI Guidelines · 3 controls

NIST Privacy Framework · 3 controls

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 1800-32 · 3 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management
  • 3.5 Securely Dispose of Data

NIST SP 800-30 · 3 controls

  • NISTSP30-1 Risk Management Strategy and Risk Assessment Programme Establishment
  • NISTSP30-2 Three-Tier Risk Assessment Scoping (Organisation, Mission/Business, Information System)
  • NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF

NIST SP 800-53 Rev 5 · 3 controls

PCI P2PE · 3 controls

PCI PIN Security · 3 controls

PCI SSF · 3 controls

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process · 3 controls

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 3 controls

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

AS9100D - Aerospace Quality Management System · 2 controls

  • AS9100D-8.1 Operational Planning and Control
  • AS9100D-8.4 Control of Externally Provided Processes, Products, Services

Annex 11 to EU GMP - Computerised Systems · 2 controls

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 2 controls

  • CPG-6.A Vendor and Supplier Incident Reporting
  • CPG-6.B Supply Chain Incident Reporting

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

ICH Q10 - Pharmaceutical Quality System · 2 controls

IRM Enterprise Risk Management Framework (Institute of Risk Management) · 2 controls

ISO 37000:2021 - Governance of Organizations · 2 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

Modern Slavery Act 2018 (Australia) · 2 controls

NERC CIP · 2 controls

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)
  • NERCCIP-8 Supply Chain Risk Management (CIP-013)

NIST SP 800-37 · 2 controls

  • NISTSP37-1 RMF Prepare Step: Organisation-Level and System-Level Preparation
  • NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation

NIST SP 800-39 · 2 controls

  • NISTSP39-4 Risk Responding: Identify, Evaluate, Decide, Implement
  • NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 2 controls

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management
  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

OECD AI Principles · 2 controls

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

OSFI B-13 · 2 controls

  • OSFIB13-1 Governance, Risk Management, and Three Lines of Defense
  • OSFIB13-4 Third-Party Risk Management and Cloud

PIC/S Guide to Good Manufacturing Practice for Medicinal Products · 2 controls

  • PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management
  • PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management

PSD2 SCA · 2 controls

  • PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements
  • PSDTWO-3 Common and Secure Communication, API Access for AISPs and PISPs

South Korea ISMS-P · 2 controls

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-J-184 Section 211.184 - Component, Drug Product Container, Closure, and Labeling Records

AML/CTF Act 2006 (Australia) · 1 control

APRA SPS 220 Risk Management (Superannuation) · 1 control

  • SPS220-28 Annual Board Risk Management Declaration

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence · 1 control

  • AS9100D-8.4 Control of Externally Provided Processes, Products, Services

Aged Care Quality Standards 2019 (repealed edition) · 1 control

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 1 control

  • ACQ.4 Supplier Monitoring

BRCGS Global Standard for Food Safety Issue 9 · 1 control

  • 3.5 Securely Dispose of Data

BREEAM - Building Research Establishment Environmental Assessment Method · 1 control

  • Mat 03 Responsible Sourcing of Materials

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

FDA Quality Management System Regulation (QMSR) · 1 control

French Sapin II Law (Law No. 2016-1691) · 1 control

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2) · 1 control

ISO 22316 · 1 control

ISO 22317 · 1 control

ISO 22318 · 1 control

ISO 22320:2018 · 1 control

ISO 26000:2010 · 1 control

ISO 41001:2018 - Facility Management Systems · 1 control

ISO 50001:2018 - Energy Management Systems · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27011:2024 · 1 control

  • 27011-5.6 Supplier relationships and telecom supply chain

ISO/IEC 38500:2024 - Governance of IT · 1 control

Kuwait National Cybersecurity Framework · 1 control

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards · 1 control

MTCS (Singapore) · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-2 Policy, Risk Management, and Roles + Responsibilities

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-1 NZISM Governance, Documentation, and Classification System

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture

OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023 Update) · 1 control

  • OECDMNE-5 Environment, Climate, and Biodiversity

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

  • OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-4 Supply Chain and Vector/Embedding Weaknesses (LLM03 + LLM08)

Open Banking Security · 1 control

  • OPENBANK-4 Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act · 1 control

  • ORSA-S1 ORSA Manual Section 1: Description of Insurer's Risk Management Framework

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-3 Personnel Security, Vetting, Awareness, and Training

Protective Security Policy Framework (PSPF) Release 2024 · 1 control

  • PSPF-DIR-001-2024 Direction 001-2024: Foreign Ownership, Control or Influence - Technology Assets

SA8000:2014 - Social Accountability Standard · 1 control

  • SAEIGHT-7 Management System, Worker Engagement, Continuous Improvement

SEC Climate Disclosure Rule · 1 control

  • SECCLIM-2 Risk Management: Identification, Assessment, Integration

SQF Code Edition 9 - Safe Quality Food · 1 control

SSAE 18 - Attestation Standards (SOC Reporting) · 1 control

  • SSAE18-CC9.2 CC9.2 - Vendor and Business Partner Risk Management

Sigstore - Software Artifact Signing and Verification · 1 control

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

Space ISAC (Information Sharing and Analysis Center) - Threat Framework · 1 control

  • GT-3 Supply Chain Compromise

Telecommunications Sector Security Reforms (TSSR) · 1 control

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK AI Regulation Framework · 1 control

  • UKAI-1 Risk-Based Approach and Pro-Innovation Principles

UK FCA/PRA Operational Resilience Framework · 1 control

  • UKOPRES-5 Third-Party Risk, Concentration Risk

UK Gambling Commission - Cyber Resilience Requirements · 1 control

UK Security and Emergency Measures Direction (SEMD) - Water Industry · 1 control

UK Telecommunications (Security) Act 2021 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Third Party and Supply Chain

Query this from an agent

The graph holds this control, the 255 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Singapore Government Instruction Manual on ICT&SS Management (IM8) controls