GV.SC-07 Supplier risk monitored over the relationship

What GV.SC-07 asks for supplier risk monitoring over the relationship

GV.SC-07 asks that the risks posed by suppliers, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to and monitored for as long as the relationship lasts, not just at signing. If your supplier risk was assessed at onboarding and has not been revisited since, this Subcategory describes the gap. The risk it addresses is simple: a supplier that was low risk when you signed can become high risk through a change of ownership, a new subprocessor, a breach, a new product release or a shift in its financial health, and a one-time review will not show it. The Subcategory sits in the GOVERN Function under Cybersecurity Supply Chain Risk Management, and it took over CSF 1.1 ID.SC-4 under a new identifier while absorbing part or all of CSF 1.1 ID.SC-2. Teams moving from version 1.1 should therefore check both older items when they map their existing supplier monitoring.

NIST publishes five Implementation Examples for GV.SC-07, and they read as a practical sequence. The first is to adjust how often and how deeply you assess each supplier based on its reputation and criticality, so a payroll processor with access to employee data is reviewed more closely than a office supplies vendor. The second is to evaluate the evidence suppliers give you, such as self-attestations, warranties and certifications, and to decide how much weight each deserves. The third is to monitor critical suppliers through inspections, audits or tests where the contract allows it. The fourth and fifth cover planning for supplier interruptions, meaning what you will do if a critical supplier fails, is breached or stops operating. Before you can do any of this, you need a current list of suppliers tied to a criticality rating. Confirm with your procurement or vendor management team whether that list exists and when it was last reconciled, because most monitoring programs fail at this step rather than at the review itself.

The difficulty is that point-in-time reviews decay quickly. A certificate or report that was current at onboarding may have expired, a subprocessor may have changed, and the staff who ran the original questionnaire may have left. Monitoring has to be scheduled, owned and recorded, with the review frequency set in advance for each criticality tier and with triggers for an earlier review, such as a reported breach or a material contract change. Ask your suppliers for the evidence you need in contracts so that monitoring is possible, because a supplier that will not allow an audit or share its attestations limits what you can verify. Record each review, the evidence reviewed and the decision taken, so an assessor can see that monitoring happened over time rather than once.

Which suppliers, systems and teams fall under GV.SC-07 monitoring

GV.SC-07 monitoring only works when the organization decides which relationships it covers and how deeply. The cards below set out the scoping decisions that follow from the GV.SC-04 supplier ranking and show how each one changes the monitoring workload.

Suppliers by criticality tier

Start from the ranking produced under GV.SC-04. Each criticality tier should map to a monitoring method, such as a lighter questionnaire review for low-tier suppliers and inspections, audits or tests for critical ones. Decide the tier boundaries before collecting evidence, because a supplier moved between tiers changes its assessment frequency and the depth of its review. Check that the tiers still match current dependencies, not the ones recorded at onboarding.

Suppliers with system or data access

Any supplier with a network connection, administrative account, API token or copy of your data belongs in scope, even if its contract value is small. The decision is whether access is persistent or occasional, and whether it reaches production or only test environments. Access paths often change through integrations that no one reviewed, so confirm the list against identity and access records rather than procurement files.

Cloud and SaaS providers

Cloud and SaaS providers often hold regulated data without appearing as a traditional supplier. Decide whether each provider is monitored through its published assurance reports and certifications, its contractual notification terms, or both. Where the provider is a sub-processor of another supplier, monitor the chain, not only the direct contract. Confirm which reports each provider issues and how often they are updated.

Managed service providers

Managed service providers often run monitoring, backup or administration on your behalf, which means their own security posture directly affects your controls. Scope them as high-impact relationships even when they are small in spend. Ask who at the provider holds privileged access to your environment, how that access is logged, and whether the provider is itself assessed for the controls it operates for you.

Open-source components maintained by third parties

Open-source components have no contract, but they still carry supplier risk when a third party maintains the code you depend on. Decide which components are in scope by their role in production and how they receive security fixes. Monitoring means tracking maintainer activity, vulnerability advisories and the release channels you trust, and deciding in advance who responds when a component is abandoned.

Teams that own each relationship

Every in-scope supplier needs a named internal owner who receives its evidence, tracks its open findings and decides when escalation is required. Without that owner, reviews of attestations and certifications are filed but not acted on. Confirm the owner matches the contract signatory or the business function that depends on the service, and that ownership transfers when staff change roles.

How assessment frequency follows supplier criticality

The first Implementation Example for GV.SC-07 makes a simple point: the format and frequency of supplier assessments should rise with a supplier's reputation risk and criticality. A vendor that prints marketing materials or runs a non-sensitive tool should not receive the same review as a provider with privileged access to production data. In practice, that means sorting suppliers into tiers using the criticality ranking you built under GV.SC-04, then assigning each tier a review depth, a review interval and a named owner. Decide the tiers and the triggers for moving a supplier up a tier, such as a new data category, expanded network access or a change of hosting location. Confirm these thresholds with your risk function before you apply them to the supplier list.

As criticality rises, the review usually moves through three stages. The lowest tier relies on a questionnaire, which the supplier completes and which you accept at face value for low-impact relationships. The middle tier asks for evidence: current certifications or attestations, penetration test summaries, a recent SOC report where one exists, and warranties or self-attestations you can test against the contract. The highest tier adds direct monitoring through inspections, audits or tests, such as a right-to-audit clause exercised or a scoped security test of an integration. Ask each supplier which of these artifacts it can provide and how current they are, because a certificate that has lapsed is weaker evidence than an open questionnaire answer from a supplier that tells you what changed.

For readers cross-referencing other frameworks, the Reference Tool lists these informative references for GV.SC-07. For SP 800-53 Rev. 5.2.0, the controls are RA-9, SA-4, SA-9, SR-3 and SR-6. For ISO/IEC 27001:2022, the mapping points to clauses 6.1.1, 6.1.2 and 6.1.3 and Annex A controls 5.19, 5.20, 5.22 and 5.31. For SP 800-171 Rev. 3, the requirements are 03.11.01, 03.16.03 and 03.17.03. For CIS Controls v8.1, the link is Safeguard 15.6. These are informative references published in the NIST CSF 2.0 Reference Tool, which show topical overlap. They are not proof that meeting one control satisfies another, so confirm the coverage against each framework's own text and your auditor's interpretation.

How an assessor tests supplier risk monitoring

This table compares what an assessor does, what they ask for and where findings usually appear across five parts of supplier risk monitoring. Read each row as a sequence: the inventory and criticality ranking set the scope, and the other rows test whether the organization followed its own stated frequency and monitoring plan for those suppliers.

Area	What the assessor tests	Common findings
Supplier inventory and criticality ranking	Samples suppliers from the register and checks that critical ones are flagged, that the ranking reflects data handled and system access, and that the criteria are written down.	Inventory omits recently added cloud or SaaS suppliers, or criticality ratings have no stated basis.
Assessment schedule	Compares each sampled supplier's last assessment date with the review frequency the organization set for its criticality tier, and checks whether the depth of assessment changed with the tier.	Schedules exist on paper but reviews are overdue, or every supplier gets the same questionnaire regardless of tier.
Review of attestations and certifications	Opens the attestation, certificate or audit report on file, checks its scope, period and expiry, and confirms someone reviewed it and recorded any exceptions or compensating controls.	Certificates are stored but expired, cover only part of the service, or were filed without any recorded review.
Monitoring of critical suppliers	Looks for evidence of ongoing checks such as security ratings, audit rights used, penetration test summaries, or incident notices, and whether results led to follow-up actions.	Monitoring depends on the supplier volunteering news, with no documented check or response to issues found.
Interruption planning	Asks for the continuity or exit plan for critical suppliers, checks that it names alternatives or fallback steps, and looks for evidence that the plan was tested or reviewed.	Plans are generic, were never updated after a supplier change, or assume the supplier will always be available.

Implementing GV.SC-07 in six steps

This sequence turns GV.SC-07 from a statement of intent into a working cycle: suppliers are assessed at a depth that matches their criticality, their evidence is checked for scope and currency, critical suppliers are monitored, interruptions are planned for, and every decision is recorded so the next review starts from a known position.

Confirm the criticality ranking from GV.SC-04
Start from the supplier register and criticality ranking produced under GV.SC-04. Supply chain risk owners, with business owners of each service, confirm that every active supplier appears, that its tier reflects the data it handles, its system access and how essential its product or service is, and that no supplier is missing because it was onboarded informally. Record the owner of each supplier and the date the ranking was last confirmed. The output is a signed-off register in which every supplier has one criticality tier and one accountable owner. Ask the same questions of any ranking inherited from a previous assessment before reusing it.
Set assessment frequency and format per tier
Define, for each criticality tier, how often the supplier is reassessed and what the assessment looks like. Lower tiers may rely on a standard questionnaire and attestation, while higher tiers may warrant document review, interviews or on-site or remote testing. NIST's Implementation Examples for GV.SC-07 describe adjusting the format and frequency of assessments by reputation and criticality, so the rule should be written as a rule, not decided supplier by supplier. Name the team that runs each assessment and the trigger events that force an early reassessment, such as a security incident at the supplier or a change in the services it provides. The output is a written assessment standard with one row per tier.
Define how attestations, warranties and certifications are evaluated
Write the evaluation criteria for supplier evidence. For each type of evidence (self-attestations, warranties, third-party certifications and reports), record what it covers, who issued it, whether the scope includes the service the organization actually buys, when it expires and what the reviewer must check before accepting it. A certificate for a different site, product line or subsidiary does not cover your service, and an expired report shows only what was true at an earlier date. Decide in advance which evidence is sufficient for each tier and when a gap must be escalated. Confirm the exact expiry and scope terms with each supplier rather than assuming them. The output is an evidence checklist and a log showing, for every critical supplier, the evidence held, its scope and its expiry date.
Set the monitoring method for critical suppliers
For critical suppliers, decide how ongoing monitoring will happen between formal assessments. The GV.SC-07 Implementation Examples point to inspections, audits or tests as the means of monitoring critical suppliers, so choose the method for each one: contractual right to audit, review of security notices and vulnerability disclosures, external attack surface checks where the contract allows them, or periodic results from the supplier's own testing. Assign a named monitor, specify what signal triggers a review and how findings are routed to the risk register. Confirm with legal that the contract permits the chosen method. The output is a monitoring plan per critical supplier that names the method, the monitor, the signals and the escalation route.
Write supplier interruption plans
For each critical supplier, write a plan for what the organization does if the service stops, degrades or is withdrawn. The plan should identify the business process affected, the workaround or alternative supplier, the data that must be recoverable without the supplier, who decides to invoke the plan and how the business owner will be told. Test that the data export and exit steps are actually possible under the contract. Link the plan to the continuity and incident response arrangements already in place so the two do not contradict each other. The output is a short interruption plan per critical supplier, reviewed by the business owner and the supply chain risk owner, with the contact points and decision rights written down.
Run a review cycle and record decisions
Hold a recurring review, at the cadence the organization sets, in which the supply chain risk owner, business owners and security staff walk through the register. Check assessments that are due, evidence that has expired or lost its scope, monitoring findings and interruption plans that need updating. Each supplier should leave the meeting with a recorded decision: accept, accept with conditions, remediate by a stated date, or exit. Keep the minutes and the decision log so an assessor can trace how a supplier's risk was handled over time. The output is a decision log that shows what was reviewed, who decided, what evidence was used and what follow-up remains open. Ask an independent assessor, when one is engaged, which records they will expect to see.

Which evidence satisfies GV.SC-07 and how to keep it current

GV.SC-07 is judged on records that show supplier risk was assessed, evaluated and watched over time, not on a single onboarding review. The cards below cover the artifacts an assessor is likely to ask for and how each one stays accurate between audits.

Dated supplier register with tiers

A register listing every supplier in scope, its criticality tier, the data and systems it touches, and the named internal owner. It is the starting point for every other artifact, because the assessment frequency for each supplier follows from its tier. Check that the register is dated, that each change records who approved it, and that new suppliers are added before they receive access. Review the tiers whenever a supplier's scope or data access changes, not only at the annual review.

Assessment schedule and completed reviews

A schedule that sets how often each tier is reassessed, paired with the completed review records. Reviews should show the questionnaire or assessment format used, the evidence reviewed, the findings and the owner's decision. Assessors look for reviews that happened on the planned dates and for evidence that the format matched the supplier's risk, such as a lighter format for low-criticality suppliers. Keep the schedule in the same system as the register so overdue reviews are visible.

Evaluated attestations and certifications

Copies of the attestations, certifications and reports a supplier provides, each recorded with its scope, issuing body, period covered and expiry date. Evaluation means noting whether the scope covers the service the organization actually buys and whether any exceptions or qualified findings affect that service. Set a reminder before each expiry date and record when a replacement was reviewed. Self-attestations and warranties count as evidence only when they are reviewed against the same criteria, and their weaker standing should be recorded.

Monitoring records for critical suppliers

Records of the inspections, audits, tests or external monitoring applied to critical suppliers, with dates, scope and results. For GV.SC-07 this is where the relationship is watched between formal reviews, for example through security rating feeds, vulnerability notices or contractual reporting. Record each finding, the supplier response and the closure date. Confirm which monitoring sources your organization has contracted for and which are only informal, because assessors will treat them differently.

Supplier interruption and transition plans

Documented plans for what the organization does if a critical supplier fails, is breached, is sanctioned or stops trading. The plan should name alternative providers or manual workarounds, recovery time expectations agreed with the business owner, and the contacts for each step. Test the plan at a planned interval and keep the test record. Update the plan when the supplier, its contract or the dependent services change, and confirm that the plan matches the continuity arrangements in the supplier contract.

Decision logs for accepted risks

A log of supplier risks the organization chose to accept, with the finding, the business justification, the approver, the compensating controls and a review date. Accepted risks are normal, but an assessor will test whether they were approved by the right level and whether they were revisited when circumstances changed. Link each entry to the supplier register and the assessment record, and close entries when the finding is remediated. An empty log for a supplier with open findings is a common gap to confirm.

What meeting GV.SC-07 costs in money and effort

This table compares the main cost components of keeping supplier risk monitored over the relationship, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. Use it to shape a written scope and to ask suppliers and partners for itemized quotes, since no price or duration is stated here.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it up or down
Tooling or licenses	Software vendor for commercial third-party risk platforms, or none for self-hosted open source	Commercial licenses recur; open-source deployment has setup and hosting costs that recur	Supplier count and user seats for commercial tools; self-hosting removes license spend but not the staff time to run it
Engineering or GRC staff time	Internal staff, plus a partner if the work is outsourced in a fixed-scope engagement	Setup is one-time; reviewing attestations and running reassessments recurs	Number of critical suppliers and how often reassessment is set by criticality; reliance on supplier-provided evidence lowers manual review but raises validation effort
Evidence upkeep	Internal owners who collect, date and store attestations, certificates and assessment records	Recurring, tied to each renewal or reassessment cycle	Number of certificates and attestations to track, expiry dates, and whether a single register holds them all
External testing or review of critical suppliers	Testing firm or assessor engaged for inspections, audits or tests of high-criticality suppliers	Usually recurring for critical suppliers; scoped per engagement	Number of critical suppliers, depth of inspection chosen, and whether the organization can rely on a supplier's independent report instead
Auditor sampling	Independent auditor or assessor, who issues any report or opinion	Recurring with each audit cycle	Sample size set by the auditor, which grows with the volume of supplier records and the number of exceptions found
Interruption planning and exercises	Internal continuity and procurement teams, and sometimes an external facilitator	Plan writing is one-time; exercises and plan updates recur	Number of single-source critical suppliers and how often plans are tested and revised

Who does what: your team, an implementation partner and the auditor

Your organization owns GV.SC-07. Your people decide how often each supplier is reassessed, which findings are accepted, which are remediated, and whether a supplier stays in use. Those decisions carry the accountability, so they cannot be delegated to a partner or an auditor. Your team also holds the supplier relationships, the contract rights to request evidence, and the authority to act when a critical supplier stops meeting expectations.

Criticality and frequency decisions: Set the tiers, assign each supplier to one, and approve the review cadence for each tier.
Risk acceptance: Record who signs off on residual supplier risk and under what conditions, with expiry dates.
Supplier relationship management: Own the contacts, requests for evidence, and escalation paths with each supplier.
Interruption planning decisions: Decide which alternatives, exit options and continuity commitments the business will fund.
Usual outsourcing: Questionnaire design support, register population from procurement data, and monitoring tooling operations.

Before you engage anyone, confirm that a named owner can approve risk acceptance and that the contracts for your critical suppliers give you a right to request evidence.

Where GV.SC-07 programs usually fall short and how to close each gap

GV.SC-07 programs tend to fail at the same few points: reviews that happen once and stop, evidence accepted at face value, and risk tiers that drift away from the actual contracts. The cards below pair each gap with the next step an organization can take, starting with the checks that cost the least and close the most exposure.

One-time due diligence never refreshed

Many organizations assess a supplier during onboarding, file the result and never revisit it. GV.SC-07 expects the assessment to follow the relationship, so a supplier's risk changes when its hosting, staff, ownership or product changes. Set a review date for each supplier based on its criticality, and trigger an earlier review when the supplier announces a material change, a breach or a new subcontractor. Check that the last review date is visible for every supplier in the register.

Attestations accepted without checking scope

A certificate or report on file does not prove that the service you buy is covered. Confirm the scope statement names the specific product, service and locations you use, and check the validity period and the issuing body. Ask whether the attestation is an independent report or a self-attestation, and record which one you hold. A supplier attestation that excludes your service should trigger a request for additional evidence, not a checkbox.

Criticality tiers left out of date

A supplier rated low when it was a minor vendor may now host production data or hold privileged access after a contract expansion. Tie the criticality tier to current contract scope, data types and system access, and rerun the rating whenever those change. Ask procurement to notify the risk team before renewals and scope amendments, so the tier and the monitoring frequency move with the contract.

No monitoring method for critical suppliers

Assessing a critical supplier once a year leaves long gaps in which its security posture can change. Choose a monitoring method for each critical supplier, such as reviewing its security reports, requesting test results, running agreed inspections or audits, or tracking its public vulnerability notices. Name an owner for each method and record what was reviewed and what was found, so the monitoring can be shown to an assessor.

No tested interruption plan

A written contingency plan that nobody has exercised rarely works when a critical supplier fails. For each critical supplier, define the service it provides, the acceptable interruption period for your operations, and an alternative such as a second provider, a manual process or a stored copy of your data. Run a tabletop exercise with the business owner and record the gaps it finds. Confirm the supplier's exit and continuity commitments in the contract before relying on them.

Evidence scattered across email and drives

When assessment answers, certificates, meeting notes and remediation emails sit in individual inboxes, the organization cannot show a complete record during an assessment. Keep one system of record for each supplier with its tier, contract dates, attestations and their expiry, review outcomes and open actions. Assign an owner to keep it current and set a periodic check that every critical supplier has a complete file. A self-hosted GRC platform can hold this record inside your own environment.

Questions buyers ask about GV.SC-07 cost, effort and outside help

Is GV.SC-07 a certification I can get?

No. GV.SC-07 is a Subcategory of the NIST Cybersecurity Framework 2.0, and NIST does not certify organizations, products or services against it. NIST also states that it has no plans to develop a conformity assessment program for the CSF. What you can do is show that your supplier monitoring operates as described, and an independent assessor may test that claim if a customer or regulator asks for it. Any statement that you are "GV.SC-07 certified" should be treated with suspicion.

How long does it take to get supplier monitoring in place, and what drives the effort?

The duration depends mostly on how many suppliers you have, how many are critical, and how much monitoring evidence already exists. Effort rises when suppliers are not yet inventoried by criticality, when assessment questionnaires differ from one team to the next, and when critical suppliers have no contractual right to audit or receive test results. Effort falls when a supplier register, risk tiers and a review calendar already exist. Ask any partner to state the assumptions behind its duration estimate in the written scope.

What does my internal team need to contribute?

Your team owns the supplier relationships, the risk decisions and the evidence. Typically that means a named owner for supplier risk, business owners who confirm how each supplier is used, and procurement or legal staff who can add monitoring rights to contracts or renewals. Security staff must review assessment results and decide what happens when a critical supplier fails a review. An implementation partner can prepare the register, questionnaires, review workflow and evidence templates, but it cannot make those decisions for you.

Can a small team run supplier risk monitoring on its own?

A small team can run it alone if the supplier count is modest and the team has clear ownership, time for scheduled reviews and someone who can read security evidence. The work is recurring, so the question is whether the team can sustain it after the first cycle. Teams that struggle usually lack a single owner, skip reviews when a project is busy, or rely on spreadsheets that nobody updates. Be honest about capacity before you commit, and consider a retainer for periodic review support if the workload is uneven.

What should I ask for in a fixed-scope quote for this work?

Ask the partner to list the suppliers and systems in scope, the criticality tiers it will use, and the assessment formats it will prepare. Request the deliverables in writing, such as the supplier register, questionnaire templates, monitoring procedures, review calendar, incident and interruption plans for critical suppliers, and the evidence file layout. Confirm what is excluded, who performs the supplier assessments, what the client must provide, and whether any ongoing reviews are included or offered as a separate retainer. The quote should follow from this written scope, not from a generic package.

Does a supplier's SOC 2 or ISO 27001 certificate satisfy GV.SC-07 on its own?

No. A third-party report or certificate is one kind of evidence you can review, but it does not replace your own assessment. You still need to decide whether the report covers the services you buy, whether its period and scope fit your use, which exceptions or findings matter to you, and what you will do about gaps. The GV.SC-07 Implementation Examples describe evaluating evidence such as attestations, warranties and certifications together, and monitoring critical suppliers beyond the paperwork. Confirm the scope and currency of any report with the supplier and its auditor.

How often do supplier reviews need to recur?

GV.SC-07 does not set a fixed review interval in the CSF itself. Its Implementation Examples expect assessment format and frequency to be adjusted by the supplier's reputation and criticality, so critical suppliers are reviewed more often and more deeply than low-impact ones. Set the cadence in your own supplier risk policy, record the reason for each tier, and trigger extra reviews after incidents, material changes or contract renewals. Your auditor will test whether the schedule was followed and whether the changes you made were justified.

How DeployOpen scopes and prepares GV.SC-07 evidence

DeployOpen works on GV.SC-07 by helping the organization decide which suppliers need monitoring, how often each one is reviewed, and what evidence proves it. We prepare the systems, records and documentation that show supplier risk is monitored over the relationship, while the organization keeps ownership of its controls and its supplier decisions.

How we scope

Each engagement starts with a written scope that names the supplier population, the criticality tiers and the systems that hold supplier records.
We agree which review cadence, attestation types and critical-supplier monitoring methods apply to each tier before any build work begins.
The scope also states who on the client side approves supplier risk decisions and who receives supplier interruption plans.

How we build

We configure self-hosted tooling inside the client's own infrastructure to hold supplier records, review dates, attestations and certification expiry tracking.
We set up workflows that flag overdue reassessments and route supplier evidence to the named owner for review and sign-off.
We draft the monitoring procedure and supplier interruption plan templates, then test them against a sample of suppliers from each tier.

How we hand over

We deliver the documented procedure, configuration records, supplier monitoring register and a sample evidence pack for the agreed scope.
We walk the client's assessors and control owners through where each piece of evidence lives and how it is refreshed.
Assessment reports and certifications are issued by independent auditors or certification bodies, not by DeployOpen, so we confirm with the client which assessor will review this evidence.

How we support

Ongoing support, upgrades and monitoring of the supplier tooling can be covered by a retainer agreed after the fixed-scope work ends.
Retainer scope should be confirmed in writing, including who reviews supplier attestations between formal assessment cycles.
Ask for the written scope, deliverable list and handover schedule before work starts, so responsibilities for each supplier review are clear.