NIST CSF 2.0 between customers and suppliers: setting supplier requirements, assessing vendor risk, showing your own alignment to a customer, using cloud services, and working with MSPs and MSSPs.
How to turn NIST CSF 2.0 into supplier requirements: NIST's C-SCRM Quick-Start Guide, rating supplier criticality, choosing outcomes per criticality level, contract clauses for vulnerabilities and SBOMs, and SLAs for ongoing monitoring.
Assessing vendors against NIST CSF 2.0 before and during the relationship: due diligence outcomes in GV.SC-06, ongoing monitoring in GV.SC-07, what evidence to accept, monitoring provider activity and planning suppliers into incident response.
What to give a customer who asks whether you follow NIST CSF 2.0: why there is no certificate, sharing a Current Profile, the evidence suppliers are commonly asked for, and mapping your existing SOC 2 or ISO 27001 controls through NIST's informative references.
Applying NIST CSF 2.0 when workloads run in the cloud: how NIST says the framework covers services operated by others, documenting shared responsibility, monitoring providers, the CSA Cloud Controls Matrix mapping and cloud Community Profiles.
Working with a managed service or managed security service provider under NIST CSF 2.0: where NIST expects outside providers to help, outsourced detection and containment, contract requirements and monitoring of the provider itself.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.