GV.SC-01 Supply chain risk program established
Setting up the cybersecurity supply chain risk management (C-SCRM) program itself: strategy, objectives, a plan with milestones, policies, processes and a cross-functional coordination mechanism.
GV.SC Cybersecurity supply chain risk management
Cybersecurity Supply Chain Risk Management: the C-SCRM program, roles, integration, supplier prioritization, contracts, due diligence, monitoring, incidents, life cycle and offboarding; ten Subcategories.
GV.SC-02 Supply chain roles and responsibilities
Defining who owns supply chain risk activities internally and what suppliers, customers and partners are responsible for, including responsibility matrices and information sharing rules with suppliers.
GV.SC-03 Supply chain risk integrated into risk processes
Integrating supply chain risk into cybersecurity and enterprise risk management, risk assessment and improvement, with integrated control sets and escalation of material supply chain risks.
GV.SC-04 Suppliers known and prioritized
Keeping a record of all suppliers and ranking them by criticality, based on the data they handle, their access to systems and how important their products or services are.
GV.SC-05 Supplier security requirements in contracts
Writing cybersecurity requirements into supplier contracts and agreements by criticality, including SLAs, vulnerability disclosure, software or hardware bills of materials and evidence of security practices.
GV.SC-06 Supplier due diligence
Due diligence and planning before a supplier relationship is formalized: assessing prospective suppliers' capabilities and risk practices and the authenticity of critical products.
GV.SC-07 Supplier risk monitored over the relationship
Managing supplier risk for the life of the relationship: assessment frequency by criticality, reviewing attestations and certifications, monitoring critical suppliers and planning for supply chain interruptions.
GV.SC-08 Suppliers in incident planning and response
Including relevant suppliers in incident planning, response and recovery: reporting rules, shared roles, joint exercises, crisis communication and joint lessons learned.
GV.SC-09 Supply chain security across the life cycle
Monitoring supply chain security practices across the product and service life cycle: provenance records, proof that components are authentic and untampered, trusted update sources and checks on hardware upgrades.
GV.SC-10 Supplier offboarding
What happens when a supplier relationship ends: termination and transition plans, end-of-life support, prompt removal of supplier access and return or disposal of the organization's data.
