GV.SC: Cybersecurity Supply Chain Risk Management
Category is new to this version of the framework and incorporates the following item from the previous version: ID.SC: Supply Chain Risk Management.
Description
Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders
Framework Subcategories
GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-04: Suppliers are known and prioritized by criticality
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
[csf.tools Note: Subcategories do not have detailed descriptions.]
GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
[csf.tools Note: Subcategories do not have detailed descriptions.]