GV.SC-06 Supplier due diligence: requirements and evidence

What GV.SC-06 supplier due diligence asks before you sign

GV.SC-06 asks your organization to plan and carry out due diligence before a formal supplier or other third-party relationship begins, so that risk is reduced before the contract is signed rather than discovered afterward. The moment this applies is the one where a procurement team has shortlisted a vendor and is about to adopt its product or service without knowing how it protects its own systems, whether its engineers can build secure software, or whether the components it ships can be trusted. The risk it addresses is simple to state: adopting a supplier whose security practices, capabilities or products are unknown, and then discovering the gap only after access to systems or data has been granted. The Subcategory is hard because the evidence arrives from outside your organization and is uneven. A prospective supplier may send a certificate, a questionnaire response or a marketing document, and each one describes its practices from its own point of view. Your team has to decide how much scrutiny a supplier deserves, which claims to verify and which to accept with conditions, and how far to go when a supplier's product will be installed on your infrastructure. The answer should scale with how critical the supplier is, which is why the Implementation Examples tie diligence to supplier risk, criticality and complexity. Within the GOVERN Function, GV.SC-06 belongs to the Cybersecurity Supply Chain Risk Management (GV.SC) Category, alongside the Subcategories that cover program setup, supplier prioritization and contract requirements. In CSF 1.1 its closest predecessor was ID.SC-1, which NIST's transition spreadsheet shows GV.SC-06 absorbs in part or in whole. Teams that previously documented supplier assessment under ID.SC-1 should check the transition spreadsheet to confirm which of their existing records carry over.

Which prospective suppliers and products fall under GV.SC-06 due diligence

Due diligence under GV.SC-06 should start with a scoping decision, not a questionnaire. The four decisions below determine which prospective suppliers get assessed, how deeply, and whether a product must be checked for authenticity before purchase. Reference points from NIST's mappings help teams document these choices, but they are starting points for scoping rather than equivalences between frameworks.

Supplier criticality and complexity

NIST's Implementation Examples for GV.SC-06 state that due diligence should be proportionate to supplier risk, criticality and complexity. Before any contract is drafted, rate the prospective supplier on how essential its service is to a business process and how hard it would be to replace or isolate. A payroll processor and a office catering vendor should not go through the same review. Record the rating and the reasoning, so an assessor can see why the depth of review differs between suppliers. Ask who approved the rating and whether it is revisited when the scope of the service changes.

Data and system access

Scope the review by what the supplier would touch. Identify whether it would store, process or transmit your data, hold administrative credentials, connect to your network, or push code or updates into your environment. A supplier with no data or system access can often be assessed with a lighter review, while one with privileged access to production needs evidence of its own security practices before onboarding. Map each prospective supplier to the systems and data classes it would reach, and keep that map with the due diligence file so it can be updated when access expands.

Critical products needing authenticity checks

Some GV.SC-06 Implementation Examples extend beyond service providers to critical products. Before acquisition, teams should check that hardware, firmware and software are authentic and have not been altered in transit. Decide which product categories fall into this group, such as network appliances, security tooling or components used in regulated systems, and define what the check involves, for example verifying vendor signatures or checksums against the vendor's published values. Ask the supplier to describe its own provenance controls in writing before purchase.

Intake ownership across internal teams

Due diligence fails when nobody owns the intake. Assign a named owner for the decision to start a review, usually procurement or vendor management, with security, privacy, legal and the business sponsor each responsible for a defined part. Document who can waive a review, who signs off on the risk rating and who can stop a purchase. Clear ownership also makes it possible to show an assessor that prospective suppliers pass through the same gate regardless of which team sources them, which is the kind of repeatable process GV.SC-06 expects.

Control reference points for scoping

NIST's CSF 2.0 Reference Tool links GV.SC-06 to SP 800-53 Rev. 5.2.0 controls SA-4, SA-9, SR-5 and SR-6, to ISO/IEC 27001:2022 clause 4.2 and Annex A controls 5.19, 5.20 and 5.31, to SP 800-171 Rev. 3 requirements 03.11.01, 03.16.03 and 03.17.02, and to CIS Safeguard 15.5. Use these as reference points when deciding which evidence to request from a prospective supplier. They do not establish equivalence between frameworks, so confirm the requirement text in each framework before treating one as satisfying another.

How an assessor tests supplier due diligence under GV.SC-06

This table sets out how an assessor typically tests GV.SC-06, the approach taken for each area, the evidence requested and the findings that come up most often. Read it as a checklist for preparing your own evidence before an independent assessment, since the assessor's conclusions depend on what your records show.

Test area	Test approach and evidence requested	Common findings
Proportionate due diligence procedure	Assessor reads the written due diligence procedure and checks whether its depth changes with supplier criticality, the data a supplier handles and how complex the service is. Ask for the criticality tiers and the due diligence steps tied to each tier.	Procedure applies the same questionnaire to every supplier, or tiers exist on paper but are not linked to any actual steps.
Sampling of recent onboardings	Assessor selects a sample of suppliers onboarded in a recent period, including at least one critical supplier, and traces each to the procedure. Expect requests for onboarding tickets, dates, and the due diligence record for each sampled supplier.	Onboarding started before due diligence finished, or the sample includes suppliers with no due diligence record at all.
Assessments of prospective suppliers' capabilities and risk practices	Assessor reviews completed assessments covering the supplier's security capabilities, risk management practices, and technology in use. Check whether findings were scored, followed up, and linked to contract terms or go and no-go decisions.	Questionnaires are returned but never reviewed, or answers are accepted without evidence such as certifications, audit reports or policy extracts.
Authenticity and integrity checks on critical products	Assessor asks which critical products were acquired in the period and looks for records showing their authenticity and integrity were checked before purchase, such as vendor verification steps, hash or signature checks, or chain of custody notes.	No defined check exists for hardware or software acquisition, or checks are performed informally with no record kept.
Approval and recording of decisions	Assessor checks that the decision to onboard each sampled supplier, including any accepted risks, was approved by someone with the authority to accept that risk, and that the approval is retained. Ask for approval records and the risk acceptance register entries.	Approvals are given verbally or by email without a link to the assessment, or accepted risks have no named owner or review date.
Consistency between procedure and practice	Assessor compares what the procedure requires with what the sampled records show, and asks staff who run onboarding how they apply it. Gaps between the written process and daily practice are a frequent basis for findings.	Staff describe steps the written procedure does not contain, or the procedure has not been reviewed since the supplier base changed.

Evidence that passes a GV.SC-06 review and how to keep it current

An assessor testing GV.SC-06 looks for records that show due diligence happened before the contract was signed, not just a policy that says it should. The six artifacts below link together: the procedure sets the rules, the intake register shows every prospective supplier, and the assessment files, decision records and verification records show the rules were applied. Each one needs an owner and a refresh routine so it still matches reality between audits.

Written due diligence procedure

This is the document that defines how due diligence scales with supplier risk, criticality and complexity, so the depth of assessment is set by tier rather than by whoever is negotiating. It should name the criteria for each criticality tier, the questionnaire or evidence each tier requires, and who may approve an exception. Check that the tiers match the supplier ranking used under GV.SC-04 and that the procedure is re-approved after material changes to the threat landscape or the business. Ask your reviewers to confirm the version history shows review dates, not only the original approval.

Pre-contract assessment files

For a sample of suppliers signed in the review period, the assessor will ask for the file that existed before signature. A complete file contains the completed questionnaire, the evidence reviewed (such as reports or certifications the supplier provided), the assessor's findings and the follow-up items agreed before contract. Keep the files in one repository with a consistent naming pattern so sampling is quick. Between audits, check that files for new suppliers close before onboarding and that open findings have dates and owners.

Risk decision records with named approvers

When a supplier has gaps and the business still proceeds, the decision must be recorded with the risk, the compensating measures, the expiry date and the person who accepted the risk. Assessors look for named approvers with authority matched to the risk tier, not a generic team name. Each record should link to the assessment file it relates to. Review open decisions on a fixed schedule so that accepted risks expire or are re-approved rather than persisting indefinitely.

Authenticity and integrity verification records

For critical products, GV.SC-06 expects checks that the item is genuine and unaltered before acquisition. Records can include vendor-published hash values compared against received media, signature verification results, certificate of authenticity checks and chain-of-custody notes for hardware. Keep each record tied to a product, version and serial or build identifier. Confirm the verification method with the vendor's published guidance, because acceptable methods differ by product type and the procedure should name them explicitly.

Supplier intake register

The intake register is the running log of every prospective supplier, its requested service, criticality tier, due diligence status and decision outcome. It shows the assessor the population from which samples were drawn, so gaps in it are more damaging than gaps in any single file. Reconcile it against procurement and accounts payable records at regular intervals to catch suppliers engaged outside the process. Assign one owner and record who last updated each row and when.

Framework mapping in CISO Assistant

CISO Assistant (AGPL-3.0-only) ships more than 200 frameworks, including NIST CSF, ISO 27001 and others, and can run audits and compliance assessments against them with automatic mapping between frameworks. Using it can help keep GV.SC-06 evidence linked to the matching ISO 27001 and NIST SP 800-53 controls, so one file serves several reviews. Before relying on these features, confirm in the version you plan to deploy which frameworks are included, how the mappings were produced and whether assessments and evidence links work as your reviewers expect.

Implementing supplier due diligence in six steps

This sequence turns the GV.SC-06 intent into a working intake process that sets review depth by supplier criticality, produces consistent evidence, and is tested on real prospective suppliers before it becomes routine.

Set criticality tiers that drive review depth
Define a small number of supplier tiers based on the data a supplier would handle, its access to your systems, and how important its product or service is to operations. The third-party risk owner drafts the tiers with the business owners who depend on the suppliers, and the CISO or risk committee approves them. Each tier states the minimum due diligence it triggers, so reviewers do not decide depth case by case. The output is a tier model with written criteria and one example supplier per tier, labeled as illustrative until you replace it with your own. The step is done when two reviewers classify the same three candidate suppliers identically.
Define the questionnaire and technical checks
Build a risk assessment questionnaire that covers the supplier's cybersecurity capabilities, its risk management practices, and how it controls its own dependencies, with questions scaled to each tier. For higher tiers, add technical checks you can perform or request: evidence of independent testing, vulnerability disclosure handling, and proof that critical products come from a verified source before acquisition. The security architect and procurement lead review the questions together so that each one maps to a decision a reviewer can act on. The output is a versioned questionnaire and a short list of technical checks, each with an accepted form of evidence.
Assign owners and approval thresholds
Name who performs each review, who signs off on each tier, and who can accept residual risk when a supplier has gaps. Procurement usually owns the request, security owns the assessment, and a named executive or risk committee owns exceptions for high-criticality suppliers. Write the thresholds in the procedure, including what happens when a supplier refuses a question or cannot provide evidence. The output is a responsibility matrix and a decision log template that records who approved, what conditions applied, and when the decision must be revisited. The step is complete when every tier has a named approver and a rule for exceptions.
Set up intake and the evidence store
Create a single intake path where business teams request a new supplier, attach the questionnaire, and submit evidence. Store questionnaire responses, supporting documents, and decision logs in one controlled repository with restricted access, retention rules, and version history. A self-hosted GRC or ticketing system inside your own environment can hold this record if it supports workflow and attachments, but confirm those features with the vendor before you rely on them. The output is a working intake form, a storage location with access rules, and a naming convention for evidence. The step is done when a test request moves from intake to a stored, retrievable file without manual copying.
Pilot the workflow on live prospective suppliers
Run the complete procedure on a small set of suppliers that are actually under evaluation, not invented test cases. Track where reviewers disagree, where questions go unanswered, and where the tier model sends a supplier to the wrong depth of review. Keep procurement timing in view, because a due diligence step that blocks every request will be bypassed. The output is a pilot log listing each issue found, the change made, and the reviewer who approved it. The step is done when the pilot suppliers have an approved or declined decision recorded in the log.
Review the procedure against sampled onboardings
After the pilot, select a sample of recent supplier onboardings and check each one against the written procedure. Confirm that the correct tier was assigned, that the required questions and technical checks were completed, that approvals came from the named owner, and that exceptions were recorded and reviewed. Feed the findings into a revised procedure, questionnaire, or tier model, and version the change. This review is also the evidence an independent assessor will ask to see when testing GV.SC-06. The output is a sampling record, a list of corrective actions with owners, and an approved revision of the procedure. Confirm the sample size and frequency with your assessor before you set them.

What supplier due diligence costs in money and effort

This table breaks supplier due diligence for GV.SC-06 into its cost components, showing who is paid for each, whether the cost is one-time or recurring, what moves it up or down, and what to request in a quote. Use it to compare an internal build with outside help before you agree a written scope. No prices or durations are given because none are published here, so the quote is the source of figures.

Cost component	One-time or recurring	What drives it up or down	What to ask for in a quote
Tooling or licenses	Recurring if commercial, one-time setup otherwise	Number of frameworks, users and suppliers tracked. A self-hosted open-source GRC tool such as CISO Assistant (AGPL-3.0-only) can remove license spend, but confirm AGPL-3.0-only obligations with counsel	Itemized license terms, hosting costs in your environment, and the licence obligations that apply to any modifications
Engineering time to configure intake workflows	One-time, with later changes	Number of supplier intake paths, integration with procurement and identity systems, and how many workflow variants are needed	Named deliverables for intake forms, approval steps, and a written handover of configuration
Assessment time per supplier by tier	Recurring with each new prospective supplier	Supplier criticality, data access and complexity. Proportionate due diligence reduces effort for low-risk suppliers	Effort assumptions per criticality tier, questionnaire versus on-site review, and who performs each step
Authenticity verification effort for critical products	Per product or per procurement cycle	Number of critical products, availability of provenance or integrity evidence from the vendor, and the testing method used	Which products are in scope, the checks performed before acquisition, and the records produced for each
Evidence upkeep	Recurring	Frequency of supplier document expiry, number of records, and how well evidence is filed and linked to decisions	Evidence register format, retention rules, and the review cadence agreed with your assessors
External review of the procedure	Periodic, usually one-time per revision	Procedure maturity, number of regulatory frameworks you are mapped to, and whether an independent reviewer is required	Reviewer credentials, scope of review, and whether findings are delivered in writing
Auditor sampling time	Recurring at each assessment cycle	Size of the supplier population, how many files the auditor samples, and how readily evidence can be retrieved	Confirm with your auditor the sample sizes and evidence formats they expect before the scope is fixed

Who runs supplier due diligence in-house and who a partner can take

Your organization owns GV.SC-06 in full. Due diligence is a risk decision, and the people who accept supplier risk must be accountable for it. Your security, procurement, legal and business owners decide which prospective suppliers are assessed in depth, what a satisfactory result looks like, and whether a supplier is approved, approved with conditions or rejected. NIST does not offer certifications for CSF implementations, so the assurance you give customers and regulators rests on your own documented decisions and the evidence behind them.

Criticality model ownership: Your team sets the criteria that scale due diligence to supplier risk, criticality and complexity, and signs off on how a supplier is classified.
Risk acceptance and approvals: Named role holders decide whether residual supplier risk is acceptable and record the approval and its conditions.
Exceptions and escalation: Decisions to onboard a supplier that fails part of the assessment go to a defined authority, with the reasoning kept on file.
Authenticity judgments: Your engineers decide whether evidence that a critical product is authentic and unmodified is sufficient before acquisition.

Check that each decision has a named owner, a documented criterion and a retained record, because these are the artifacts an assessor will ask to see.

Where supplier due diligence usually falls short and how to close each gap

GV.SC-06 asks that planning and due diligence happen before a supplier relationship is formalized. In practice, the same few gaps appear again and again: checks that start too late, one-size questionnaires, unverified product authenticity, undocumented decisions, findings that never reach the contract, and records no one can sample. Each card below names a gap, the fix and the evidence an assessor would expect to see.

Due diligence starts after signature

Many teams run security review once procurement has already agreed terms, so the findings can only be handled as exceptions. GV.SC-06 expects planning and due diligence to come first, so the outcome can change whether the supplier is selected at all. Fix this by adding a security gate to the intake workflow that blocks purchase approval until the assessment for the supplier's criticality tier is closed. Evidence that the gate works: dated intake tickets showing the assessment completed before the contract execution date, and a few procurement files where the gate delayed or changed a decision. Confirm the sequence with your procurement and legal teams before you rely on it.

One questionnaire for every supplier

A single long questionnaire sent to every prospective supplier wastes effort on low-risk vendors and gives too little depth on the ones that handle sensitive data or privileged access. The Implementation Examples for GV.SC-06 call for due diligence proportionate to supplier risk, criticality and complexity. Fix this by defining two or three assessment depths, each tied to criteria such as data classification, system access and substitutability, and assigning each prospective supplier to a depth before questionnaires go out. Evidence: a documented tiering rule, the tier recorded for each supplier, and the matching questionnaire version used for each tier.

No evidence that critical products are authentic

For hardware, firmware, software packages and components, due diligence often stops at the supplier's word. GV.SC-06 includes checking critical products for authenticity and integrity before acquisition, which means the organization needs a way to verify what it is buying. Fix this by listing the critical product types, then defining the checks for each, such as verifying vendor-issued signatures or hashes, confirming chain-of-custody documents and inspecting packaging or serial records on receipt. Evidence: a verification procedure, completed check records tied to specific purchase orders, and documented exceptions with the approver who accepted them.

Decisions without named approvers

When a supplier is approved informally, no one can later show who accepted a known risk or on what basis. This matters during audits and after an incident, when reviewers ask why a high-risk supplier was onboarded. Fix this by requiring a recorded decision for each assessed supplier that names the approver, the risk owner, the findings accepted, and any conditions attached. The approver should hold authority matched to the supplier's tier, so a low-tier approval cannot clear a critical supplier. Evidence: signed or system-recorded approval entries with dates and conditions.

Findings that never reach contract terms

Assessments can identify gaps in encryption, incident reporting or vulnerability handling, yet the contract that follows says nothing about them. GV.SC-06 is about reducing risk before the relationship is formalized, and that reduction depends on carrying findings into the agreement. Fix this by mapping each significant finding to a clause, a remediation commitment or a compensating control, and tracking it until the contract is signed. Evidence: a findings-to-contract traceability table, the signed clauses it references, and a note of any risk accepted without a contract change. Ask counsel to confirm how these requirements are worded.

Intake records that cannot be sampled

Due diligence files are often scattered across email threads, shared drives and spreadsheets, so an auditor selecting a sample of suppliers cannot quickly pull a complete file. A record that cannot be retrieved is hard to rely on, even if the work was done. Fix this by keeping one record per supplier with a consistent set of fields: tier, assessment date, evidence reviewed, findings, approver and contract reference. Store the evidence in a controlled repository with version history. Evidence: a register that can be filtered by tier and date, and a test in which a reviewer selects several suppliers at random and reconstructs each file from the register alone.

Questions buyers ask about GV.SC-06 cost, effort and outsourcing

How much effort does GV.SC-06 supplier due diligence take?

The effort depends mostly on how many prospective suppliers you assess, how critical the product or service is, and how much evidence you must collect and review before signing. GV.SC-06 asks for due diligence proportionate to supplier risk, criticality and complexity, so a low-impact software tool needs a lighter review than a provider that will hold regulated data or run part of your production environment. Effort is front-loaded: the first cycle requires designing the questionnaire, risk tiers and approval steps, and later cycles mostly repeat them. Ask any partner to break its estimate into planning, supplier assessment, product authenticity checks and documentation, so you can see where the hours go.

Can an organization meet GV.SC-06 without outside help?

Yes. NIST's CSF 2.0 does not require a consultant, and an internal team with procurement, security, legal and the business owner can build a due diligence process. The harder parts are usually consistency and time: applying the same questions to every supplier, documenting why a supplier was accepted, and checking the authenticity of critical products before acquisition. Internal teams often need outside help when they lack assessment experience, have no tooling to track suppliers, or face a customer or regulator that expects a documented, tested process. Outside help is a choice about capacity and skill, not a requirement of the subcategory.

What does GV.SC-06 need from our own staff?

Your staff must own the decisions, even when a partner prepares the material. The organization is responsible for its controls, so someone accountable must approve the due diligence criteria, accept or reject suppliers, and decide what residual risk is tolerable. Typical roles include a supply chain or procurement owner, a security reviewer who can read supplier evidence, a legal reviewer for contract clauses, and a business owner who understands the service. Each role needs time in the process, and someone must keep the supplier records current. Confirm these responsibilities in writing before work begins so that gaps do not appear during an assessment.

How long does GV.SC-06 implementation take?

No duration has been established for this work, and any figure quoted without a written scope should be treated with caution. The timeline depends on the number of suppliers in scope, the maturity of your existing procurement records, how quickly internal approvers respond, and whether you need new tooling. Ask any provider for a written schedule with milestones, the dependencies on your staff and the points where your approval is required. A fixed-scope agreement should state the deliverables and dates before work starts, so you can measure progress against them.

Can our auditor help us design the supplier due diligence process?

No. An independent auditor, assessor or certification body must remain independent of the controls it tests, so it cannot design the process it will later evaluate. Auditors can explain what evidence an assessment will look for, and they can review your process once it exists, but building it is the organization's job, with or without an implementation partner. An implementation partner can prepare systems, questionnaires, tracking records and evidence folders, but it does not issue reports or certificates. Keep the roles separate in your contracts and project plan so the assessor's independence is not questioned.

Which parts of GV.SC-06 are worth outsourcing?

The parts that benefit most from outside help are the ones that need specialized technical depth or repeatable tooling. Common examples include building a standard assessment questionnaire, configuring a self-hosted GRC or tracking platform to hold supplier records and evidence, reviewing technical supplier evidence such as security documentation, and testing whether critical products are authentic and untampered. Decisions to accept a supplier, interpret residual risk and sign contracts should stay with your organization. Outsourcing a bounded piece, such as the tooling and evidence structure, often gives you a clearer result than handing over the whole subcategory.

What should we ask a partner before signing a fixed-scope agreement?

Ask the partner to state the scope in writing, including which suppliers, products and systems are covered, which deliverables you will receive, and the dates for each. Confirm who owns each control and each decision, and which tasks depend on your staff. Ask how authenticity and integrity checks for critical products will be performed, what evidence will be retained, and where that evidence will be stored. Request a list of exclusions, the process for change requests, and how the partner will handle questions from your auditor. Make sure the agreement states that the partner prepares evidence but does not issue audit reports or certifications.

What drives the cost of GV.SC-06 and what recurs after the first cycle?

The main cost drivers are the number of suppliers, the criticality of each one, the number of products requiring authenticity checks, and the amount of tooling you need. One-time costs include designing the process, building questionnaires and setting up the records system. Recurring costs include reassessing suppliers, updating risk tiers when services change, and reviewing evidence when contracts renew. Internal staff time is a cost even when no invoice is issued. Ask for a quote that separates one-time setup from recurring work, and that identifies which effort is paid to a partner and which remains with your team.

How DeployOpen scopes and prepares GV.SC-06 supplier due diligence

DeployOpen helps organizations build the planning and due diligence records that GV.SC-06 expects before a supplier relationship is formalized. We plan, build and document the supporting systems and evidence in your own infrastructure, while your organization keeps ownership of its supplier decisions and any independent assessment stays with the assessor you choose.

How we scope

Agree a written scope listing the prospective supplier categories, criticality tiers and systems covered by due diligence.
Confirm which SP 800-53 Rev. 5.2.0, ISO/IEC 27001:2022 or SP 800-171 Rev. 3 references your auditors will use for GV.SC-06.
Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts; ongoing support is available as a retainer.

How we build

Configure a self-hosted GRC workspace to hold supplier questionnaires, risk assessments and review records for prospective suppliers.
Build a due diligence workflow that scales depth to supplier criticality, complexity and the data each supplier would handle.
Set up checks for the authenticity and integrity of critical products before acquisition, with the results recorded as evidence.

How we hand over

Document the due diligence procedure, roles, approval gates and evidence locations so your team can run it without us.
Deliver a mapping from each GV.SC-06 Implementation Example to the workflow, records and owners that address it.
Test the workflow with your team on sample prospective suppliers and hand over the results and open items in writing.

How we support

Provide preparation of evidence for your independent assessor, who alone issues any report or certification.
Review supplier due diligence records periodically under a retainer, updating the workflow as your supplier base changes.
Confirm with your assessor which evidence formats and sampling they expect before the assessment begins.